857baf317468e83abc045d7e6c0b11ef45626a55147fad36b211a8f73ceb0e83

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Inquiry ACK2-02500.vbs
Size 285KB
Sample260817-pegmgsbc25
SHA256 857baf317468e83abc045d7e6c0b11ef45626a55147fad36b211a8f73ceb0e83
MD5 45d673f8abf4dfa76e0c8b04a576641d
SHA1 25e633214677e7a03b8ddd1a047e936597a9d5e2
SHA512 828f2edad7985a35c73b31122feb58eeab227e28c14486c44ae4225a206593ac6904a1491d2d01db40ccf51d4959d0886b25cd78ca82d575406bf21f7b7f0120
SSDEEP 6144:7hAfbE765MM211/vjvsb650O8nmwgRM8E4V:7hAA7p11/vjvsbOXDE+
TLSH
T144541E516D857C84B07ED112DACF8B96E078FE92F7671A0A65E3829403E0644FD83B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4628	powershell.exe
17	4628	powershell.exe
24	4628	powershell.exe
39	4628	powershell.exe
42	4628	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4628	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
42	4628	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1096	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4628 set thread context of 4804	4628	powershell.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4628	powershell.exe
4628	powershell.exe
4804	regsvcs.exe
4804	regsvcs.exe
4804	regsvcs.exe
4804	regsvcs.exe
4804	regsvcs.exe
4804	regsvcs.exe
4804	regsvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4628	1096	WScript.exe	86
PID 4628 wrote to memory of 4804	4628	powershell.exe	103
PID 4628 wrote to memory of 4804	4628	powershell.exe	103
PID 4628 wrote to memory of 4804	4628	powershell.exe	103
PID 4628 wrote to memory of 4804	4628	powershell.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Inquiry ACK2-02500.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\74FE5B49E\74FE5B49E.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4804

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

74FE5B49E.ps1

Path C:\Users\Admin\AppData\Local\Temp\74FE5B49E\74FE5B49E.ps1
Size 1KB
SHA256 1f1267f5f72d9c497db6ef78dc2aafc3b917ea855d70a98c77a195a2a915ac67
MD5 fc39e1fbbeabc25d0dc791aef050e680
SHA1 694dcbd88e78ac54602623074d5dbaca3b5ee807
SHA512 f9980194df65d3ba7270957ea53da41f6f82bc0cabbecf14183912f57f847e3eb7f98df7b4fe8e5b8ec9df146e2d044d1fb7c80a0babb9a42eec5d0ad4ca0506
TLSH
T10031122255C3FFB410B081B79F326AC496641D4D638DBB15F65CC9481A4524CAAD87DA
MD5 SHA1 SHA512 TLSH

Submit Download

74FE5B49Ea

Path C:\Users\Admin\AppData\Local\Temp\74FE5B49E\74FE5B49Ea
Size 64KB
SHA256 12fe64b7992be18053bcc9c9c40eda0d90e8728fc1a12ec0ca5c802ed8ecb8ad
MD5 12cb3f2139a43b87a63af16d97067c9a
SHA1 247b97bc6527abc22342ac591fc38695233a5fc4
SHA512 99539180ccf562f7e91a2e759187f74a36b0c47e7fc44828a40d75b683ce50e72b2a5322707773b7e7171e9a4b87158b7afb521d26989841555aa9f4415dac86
SSDEEP 1536:fdk+eBHkAmWbmQSSb2kIRy2PI/ziImOqdbOlzJ1WSuT/HAfh:Gh5kSqy2wzi/OwbOllRoAZ
TLSH
T1F4530268BF580A2BA1C4475DB472571129C10DEC20DBAF9A1AD5F4BE09EDEBCD13F188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74FE5B49Eb

Path C:\Users\Admin\AppData\Local\Temp\74FE5B49E\74FE5B49Eb
Size 64KB
SHA256 eabcf0cfbc6ba1886908558102069d8353dc370e584f07ca7a867634e98116c5
MD5 456ba992cf4a538fcf6f1e3df7e673e4
SHA1 1ab601aa8ed05cfa17d072e457c4b07999692064
SHA512 0f2acf7e82a037e59762d9193d97be75b0a18dfcd7d17191aba267830c173137a7e5d435595917e87682b16bb09fb3694d9762da9925d6d2f23da9e4559cc1db
SSDEEP 1536:un+wL5IATBNVgt0icxs6pjOhggj1EvlruqG:u+Y5fL6cK6pjIjGvxG
TLSH
T1D153F1082F474C8C261C142761C6FE884B826EF49394D7A265BDDBD61387CA7E95CCEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fshbdbbj.1ci.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fshbdbbj.1ci.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4628-5-0x000001C22B3F0000-0x000001C22B400000-memory.dmp

Download

memory/4628-4-0x000001C22B3F0000-0x000001C22B400000-memory.dmp

Download

memory/4628-6-0x000001C22D630000-0x000001C22D652000-memory.dmp

Download

memory/4628-17-0x000001C22D9D0000-0x000001C22DA20000-memory.dmp

Download

memory/4628-18-0x000001C22D9A0000-0x000001C22D9B2000-memory.dmp

Download

memory/4628-19-0x000001C22B3F0000-0x000001C22B400000-memory.dmp

Download

memory/4628-20-0x000001C22B3F0000-0x000001C22B400000-memory.dmp

Download

memory/4804-21-0x0000000000A30000-0x0000000000A76000-memory.dmp

Download