2995448ef6098df020183e079be1daca9eb809eae91859ae1b56f608d70d4611

Analysis

max time kernel
300s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO-2026-17085.vbs
Size 293KB
Sample260820-e14zsszbla
SHA256 2995448ef6098df020183e079be1daca9eb809eae91859ae1b56f608d70d4611
MD5 cdf279de18ea8ce3291e0a67f4ed5b2d
SHA1 07a4395273d255f83a5f01acf71e1ae71dbaae49
SHA512 8c5091917fe3b4e4151118e218fe0eb13f6b20df1a21017ba132dd08dec528d91059d3fb4fd7bc5c99e8adf04109ab8d7851fccc4c4368e168c766b452e003be
SSDEEP 3072:Q25C/YPNccJbVEWyHaBnBafRfv3SnbWfRrwYb9f7tqZXJorWZMlPwY9:Q2k/b2b/yHaBnBqAbML95frOY9
TLSH
T18D543F656DC17C84F07AD112DBCB8797E068FE91F7672A0665E383A403E0644BD83A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5432 created 2988	5432	powershell.exe	80

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5432	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5432	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3396	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5432	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5432	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5432	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 5432	3396	WScript.exe	91
PID 5432 wrote to memory of 5504	5432	powershell.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2988
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO-2026-17085.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\9F6F2B49E\9F6F2B49E.ps1"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5432
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:5504

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9F6F2B49E.ps1

Path C:\Users\Admin\AppData\Local\Temp\9F6F2B49E\9F6F2B49E.ps1
Size 1KB
SHA256 6d3cb13bac3ce045d8a98b92bd807c9ae8f13fb192dcd7721ad82c148ad31cfc
MD5 6f456cbc75eb94bc0503394d43277c1e
SHA1 c7d64e4da5b66492ece0208184bb45fc59a8af81
SHA512 51a50c87f804bc83236ba3cb27f9a6da876993d72800f9871cbac03c8c8afda0d7da837e193c40acf7b8d658757c03d445e6f7ce38c6db74138056526e03ca2f
TLSH
T16031F060068FEF28049545638E91468CA827AE3EBD8DEE4177DECA2821471027BD6B4D
MD5 SHA1 SHA512 TLSH

Submit Download

9F6F2B49Ea

Path C:\Users\Admin\AppData\Local\Temp\9F6F2B49E\9F6F2B49Ea
Size 67KB
SHA256 caa39f7c9f349ae6c85975cfba907b8b2ae60bee5dd1bc0a452b7bff9c2c7d0a
MD5 a8dd80d9659ddba81cad0970df9a8fcb
SHA1 4787055f34d777e0c8d4346eda3ad1400834a396
SHA512 fe1d676f1404ae96e2780a0eabaccd92880bcbf5fdd3b5d4f6ba1d0124fba645a041ec6cb8a6368b2284d36ae92df096ac707d6375153190e53228b87991445f
SSDEEP 1536:BIQybTXEe4RmDU6tDCA1MuQJMtLPM4T6pngiC1c0:BQrcR6gxVetLPM4KgiKj
TLSH
T1596312365826BFB4693342ECAA5B53C0995118F2A45530AA9F22FECF5D1CFE34C8B14C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9F6F2B49Eb

Path C:\Users\Admin\AppData\Local\Temp\9F6F2B49E\9F6F2B49Eb
Size 67KB
SHA256 2b96c99a6880978e06a829b9e6a0092439c74a2366e8e5625fb8d334c47bf75b
MD5 17f01415138dcfb3a3ba7641e78a7fde
SHA1 ebe5e6a96e995cd282ebb36c0ee446756f705bd7
SHA512 dbc231875ea0309d78e8e677942ed85cc1ab81c85f06e01d8bc00818c43f5c7a6d95c094063fcc2da882731e5e542c406b340659aa3a10d638aa64ff298fdcb6
SSDEEP 1536:hMF+4fl8iDreMKzjwjQgwHe+f3cuWDzZ0O6Uq:eZmAyjGNK3cuWH1tq
TLSH
T16F631334AC6465A0FF9ADE3CFD22B8B521266B834745DDDC868375DFB5A188093F8C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5432-16-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-17-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-6-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-12-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-7-0x000001DBE2880000-0x000001DBE28A2000-memory.dmp

Download

memory/5432-13-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-14-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-3-0x00007FFE4128F000-0x00007FFE41290000-memory.dmp

Download

memory/5432-15-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-8-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-19-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-20-0x000001DBFAE50000-0x000001DBFAE62000-memory.dmp

Download

memory/5432-21-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-18-0x000001DBFAE60000-0x000001DBFAEB2000-memory.dmp

Download

memory/5432-22-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-24-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/5432-25-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download