523f21fad7e3e8c4ffd9897b875c0df9609a825fd0c9d274319da132fa358cb9

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Microsoft Excel.vbs
Size 477KB
Sample260924-nklmysce33
SHA256 523f21fad7e3e8c4ffd9897b875c0df9609a825fd0c9d274319da132fa358cb9
MD5 cb14c2df418eb62dc84a5dc9397fee6b
SHA1 b2ebd7cd0887f35b3048520b5565797683af2f80
SHA512 f2c0bb90ae23f08fb5770e640d33d58995771934ae6c75ef7232ac2c6a5465e861f31e725480349a151ccdaf289f4757632c3e71a432d979f7729955b1378f12
SSDEEP 6144:nXVeCMCxqsXNV9Hy8ZosM1r9kZlFmBk45GheNuVpC4fI7U06x9TpOorQfTsOdcSi:l
TLSH
T129A40B2CB18799BEF5AD10E174FCBFB141B931EB13C866A160748618E3D6EDD6C811E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2988	wscript.exe
3	2988	wscript.exe
4	2988	wscript.exe
5	2988	wscript.exe
6	2988	wscript.exe
7	2988	wscript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysMonPort.vbs	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMonPort = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\SysMonPort\\SysMonPort.vbs\""	wscript.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3648	WScript.exe
2988	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2992	cmd.exe
3444	cmd.exe
5104	cmd.exe
3704	cmd.exe
3424	cmd.exe
2060	cmd.exe
896	cmd.exe
1248	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3668	PING.EXE
1248	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3668	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2760	schtasks.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	5	VBScript-Telegram-Bot/1.0
HTTP User-Agent header	7	VBScript-Monitor-Bot/1.0

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4936	WMIC.exe
4936	WMIC.exe
4936	WMIC.exe
4936	WMIC.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4936	WMIC.exe
Token: SeSecurityPrivilege	4936	WMIC.exe
Token: SeTakeOwnershipPrivilege	4936	WMIC.exe
Token: SeLoadDriverPrivilege	4936	WMIC.exe
Token: SeSystemProfilePrivilege	4936	WMIC.exe
Token: SeSystemtimePrivilege	4936	WMIC.exe
Token: SeProfSingleProcessPrivilege	4936	WMIC.exe
Token: SeIncBasePriorityPrivilege	4936	WMIC.exe
Token: SeCreatePagefilePrivilege	4936	WMIC.exe
Token: SeBackupPrivilege	4936	WMIC.exe
Token: SeRestorePrivilege	4936	WMIC.exe
Token: SeShutdownPrivilege	4936	WMIC.exe
Token: SeDebugPrivilege	4936	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4936	WMIC.exe
Token: SeRemoteShutdownPrivilege	4936	WMIC.exe
Token: SeUndockPrivilege	4936	WMIC.exe
Token: SeManageVolumePrivilege	4936	WMIC.exe
Token: 33	4936	WMIC.exe
Token: 34	4936	WMIC.exe
Token: 35	4936	WMIC.exe
Token: 36	4936	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4936	WMIC.exe
Token: SeSecurityPrivilege	4936	WMIC.exe
Token: SeTakeOwnershipPrivilege	4936	WMIC.exe
Token: SeLoadDriverPrivilege	4936	WMIC.exe
Token: SeSystemProfilePrivilege	4936	WMIC.exe
Token: SeSystemtimePrivilege	4936	WMIC.exe
Token: SeProfSingleProcessPrivilege	4936	WMIC.exe
Token: SeIncBasePriorityPrivilege	4936	WMIC.exe
Token: SeCreatePagefilePrivilege	4936	WMIC.exe
Token: SeBackupPrivilege	4936	WMIC.exe
Token: SeRestorePrivilege	4936	WMIC.exe
Token: SeShutdownPrivilege	4936	WMIC.exe
Token: SeDebugPrivilege	4936	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4936	WMIC.exe
Token: SeRemoteShutdownPrivilege	4936	WMIC.exe
Token: SeUndockPrivilege	4936	WMIC.exe
Token: SeManageVolumePrivilege	4936	WMIC.exe
Token: 33	4936	WMIC.exe
Token: 34	4936	WMIC.exe
Token: 35	4936	WMIC.exe
Token: 36	4936	WMIC.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 896	3648	WScript.exe	91
PID 3648 wrote to memory of 4156	3648	WScript.exe	93
PID 3648 wrote to memory of 2988	3648	WScript.exe	95
PID 3648 wrote to memory of 1248	3648	WScript.exe	96
PID 1248 wrote to memory of 3668	1248	cmd.exe	98
PID 2988 wrote to memory of 2992	2988	wscript.exe	99
PID 2992 wrote to memory of 4936	2992	cmd.exe	101
PID 2988 wrote to memory of 3444	2988	wscript.exe	103
PID 3444 wrote to memory of 2724	3444	cmd.exe	105
PID 2724 wrote to memory of 1532	2724	query.exe	106
PID 2988 wrote to memory of 5104	2988	wscript.exe	108
PID 5104 wrote to memory of 1400	5104	cmd.exe	110
PID 2988 wrote to memory of 3704	2988	wscript.exe	111
PID 3704 wrote to memory of 704	3704	cmd.exe	113
PID 2988 wrote to memory of 3424	2988	wscript.exe	114
PID 3424 wrote to memory of 5960	3424	cmd.exe	116
PID 2988 wrote to memory of 2760	2988	wscript.exe	117
PID 2988 wrote to memory of 2060	2988	wscript.exe	119
PID 2060 wrote to memory of 3136	2060	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4156	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Microsoft Excel.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic bios get serialnumber > "C:\Users\Admin\AppData\Roaming\SysMonPort\sn.tmp"
  2⤵
  - Executes a command shell one-liner
  PID:896
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +h +s +r "C:\Users\Admin\AppData\Roaming\SysMonPort\SysMonPort.vbs"
  2⤵
  - Views/modifies file attributes
  PID:4156
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\SysMonPort\SysMonPort.vbs"
  2⤵
  - Badlisted process makes network request
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic bios get serialnumber > "C:\Users\Admin\AppData\Roaming\SysMonPort\sn.tmp"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4936
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c query user > "C:\Users\Admin\AppData\Roaming\SysMonPort\query_user.tmp" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:1532
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /Query /TN "SysMonPort" > "C:\Users\Admin\AppData\Local\Temp\task_check_7055.tmp" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\system32\schtasks.exe
      schtasks /Query /TN "SysMonPort"
      4⤵
      PID:1400
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /Query /TN "SysMonPort" /FO LIST /V > "C:\Users\Admin\AppData\Local\Temp\task_q_5334.tmp" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\system32\schtasks.exe
      schtasks /Query /TN "SysMonPort" /FO LIST /V
      4⤵
      PID:704
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /Query /TN "SysMonPort" > "C:\Users\Admin\AppData\Local\Temp\task_check_5795.tmp" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\schtasks.exe
      schtasks /Query /TN "SysMonPort"
      4⤵
      PID:5960
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "SysMonPort" /TR "wscript.exe "C:\Users\Admin\AppData\Roaming\SysMonPort\SysMonPort.vbs"" /SC ONLOGON /RU "admin" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2760
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /Query /TN "SysMonPort" > "C:\Users\Admin\AppData\Local\Temp\task_check_2895.tmp" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\system32\schtasks.exe
      schtasks /Query /TN "SysMonPort"
      4⤵
      PID:3136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 > nul & del /F /Q "C:\Users\Admin\AppData\Local\Temp\Microsoft Excel.vbs"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3668

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

task_check_2895.tmp

Path C:\Users\Admin\AppData\Local\Temp\task_check_2895.tmp
Size 256B
SHA256 f64728f4054eb4383f4d369c37bddc97ae2bd44a027af769a6c92d9850cd152a
MD5 3848b6806953f5ba274a6f4f709ef6c3
SHA1 80d3c3f7a83fde173371350e10f535280a95c6b1
SHA512 8574f25fc66158232d942e2b605489b9ed0101e027020363c1c22335b771a3d23b9dccca5e67ad4a671883361805cc153a0d19cf535dc321ef89fd3f759aad0b
TLSH
T16DD0128340400780C484D392323494017D9105232B376B1074CC3640A36E3CA0BC4460
MD5 SHA1 SHA512 TLSH

Submit Download

task_check_7055.tmp

Path C:\Users\Admin\AppData\Local\Temp\task_check_7055.tmp
Size 52B
SHA256 bd02abdb9d556752d37693bef327d6042b79e5202cbda2eaddeefc0d00b1fc58
MD5 5d88aa2a1fe58aff43274e631de5b614
SHA1 e57f14c3bc61d4c744c8e4a843d8d86a6450bc08
SHA512 21f5fc5c9836174bd7ffe1fb6fd0fe13074b96b23cff3d16b5467df38a0b909457b2a7b63a796cef407137d908456de476ce667678901f1079b2f144cc7fd1b9
TLSH
T19D9002891FD1426854B48142664D516011527D9A0420535424CE0A6560258593EB2A60
MD5 SHA1 SHA512 TLSH

Submit Download

query_user.tmp

Path C:\Users\Admin\AppData\Roaming\SysMonPort\query_user.tmp
Size 161B
SHA256 f74241e0d5fcd1a9d148dbdce45ef3837f46d2ea4eb5d423f82aab6c074df4bf
MD5 40845655546a4c38581a5c3f559e7ff9
SHA1 1fc42ab69f0ea9bac4b07a856bf05e50bd808f5b
SHA512 d06d93c8ea158b95d302753f81447573b358318e7c62fc272f31ffa5081dbba101dea781f204034d0d136c820726bb7a3bf1e17fd0d4b05763498afe96ba9d62
TLSH
T16BC09B1BD664503585459655A567897066B030D039207077365C074407B1514FB6C19B
MD5 SHA1 SHA512 TLSH

Submit Download

sn.tmp

Path C:\Users\Admin\AppData\Roaming\SysMonPort\sn.tmp
Size 70B
SHA256 5c3b49db1374e42e5047a3ab05b1ee7577cf78cf6e875889a164f54d1af6257b
MD5 5b21bdfd2dcb4143105a1642e631bf89
SHA1 0921933e59eacc03e31a28dd8be977bc2726ee21
SHA512 41608db131f901209389d780a5ff1561f0c1dcc0cd2b2d8ed87f60bef852b80925d6f1ca8c9230558635ea4aff4f7c1c9ec099ca5d1b3a85514b26c57b517ae4
TLSH
T1DCA00243C7DC218EF1F64514FD30506C1BC330C11D7E014C0048002B86F784446103D7
MD5 SHA1 SHA512 TLSH

Submit Download