004dffe919dd01d7871449f9fbe829b6ae63f4e5d3a9e107766deadec7dcc7f8

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Proforma Invoice.vbe
Size 3KB
Sample260930-kel5rayw7m
SHA256 004dffe919dd01d7871449f9fbe829b6ae63f4e5d3a9e107766deadec7dcc7f8
MD5 8254e73cd9f83a53cc73933e02783fe9
SHA1 961332d87a6077451ae824159dedbaf0574b6fdf
SHA512 e62a96934346e2781d76036d1530d833d325e8952c353e16c05bf4d57a597eb85abb1a708f3a58f1639802d514a093c037de41f09dc47fb4d9841caf1d89e295
TLSH
T1DF7101037707E1758CB18BB6C99FA809D5E02D57AC0F08057DCD89D26F3539AB5F90A2
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4336	WScript.exe
7	4336	WScript.exe
12	4336	WScript.exe
19	4336	WScript.exe
22	4336	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4336	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3288	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3288	powershell.exe
3288	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3288	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 3288	4336	WScript.exe	88

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.vbe"
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\WMLNFFEV.ps1"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMLNFFEV.ps1

Path C:\Temp\WMLNFFEV.ps1
Size 11KB
SHA256 a9282a1acb55889ff7b4ceb153194bb9422d22d42c3d1e06d2f564d5db5d398b
MD5 a4663e99e9f9e31eeec98d96f1c140cf
SHA1 59fa373efa237d0a4da1c7513510d38bdb5a78e8
SHA512 2b0f6b815ff558e89168f8cd810ad9fe5446d5e7a38971d1d7cd0fbeefd7f1c7902e8ab77dd2233a1523296275547798f1387e3dda03e219e7120f9323d85adb
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzKXbqFtCJSOdRUM:sXX+/DV7k/3RFtKRUM
TLSH
T1E842195CAED1A2B0FA1707DE73AF29690268A0C7200DC484F54CDDE87F4ABDC4A56B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hdakxewl.o1k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hdakxewl.o1k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3288-13-0x0000027AA19F0000-0x0000027AA1A00000-memory.dmp

Download

memory/3288-16-0x0000027AA1990000-0x0000027AA19B2000-memory.dmp

Download

memory/3288-12-0x0000027AA19F0000-0x0000027AA1A00000-memory.dmp

Download

memory/3288-23-0x0000027AA19F0000-0x0000027AA1A00000-memory.dmp

Download