004dffe919dd01d7871449f9fbe829b6ae63f4e5d3a9e107766deadec7dcc7f8

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Proforma Invoice.vbe
Size 3KB
Sample260930-kel5rayw7m
SHA256 004dffe919dd01d7871449f9fbe829b6ae63f4e5d3a9e107766deadec7dcc7f8
MD5 8254e73cd9f83a53cc73933e02783fe9
SHA1 961332d87a6077451ae824159dedbaf0574b6fdf
SHA512 e62a96934346e2781d76036d1530d833d325e8952c353e16c05bf4d57a597eb85abb1a708f3a58f1639802d514a093c037de41f09dc47fb4d9841caf1d89e295
TLSH
T1DF7101037707E1758CB18BB6C99FA809D5E02D57AC0F08057DCD89D26F3539AB5F90A2
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2376	WScript.exe
4	2376	WScript.exe
8	2376	WScript.exe
9	2376	WScript.exe
10	2376	WScript.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2376	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2764	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2764	powershell.exe
2764	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2764	2376	WScript.exe	89

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.vbe"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\XJZNOKYI.ps1"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XJZNOKYI.ps1

Path C:\Temp\XJZNOKYI.ps1
Size 11KB
SHA256 78e56396f954cd2369e76aed7f4a99f54d5255cc2d34dbc3ea8ae504725ffa3f
MD5 383af867a8097969d6c70352d03d1631
SHA1 c6943ee47d798a0f457cce4155e6d9974ff473a3
SHA512 b4f069ec3d65984f00f968acc454964ac13ecfcce42ef7f4104844394647fdb1eb1965b212c53bc84d405592f45c0b601c77d26ffa2a2e1e30eb0f000d273e0f
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzKXbqFtCcSP5RUM:sXX+/DV7k/3RFtyRUM
TLSH
T13732185CAED1A1B0FA1707DEB3AF29690268A0C7200DC484F54CDDE87F4ABDC4A56B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2764-22-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp

Download

memory/2764-16-0x000001D3EF650000-0x000001D3EF672000-memory.dmp

Download

memory/2764-17-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp

Download

memory/2764-13-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp

Download

memory/2764-21-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp

Download

memory/2764-12-0x00007FF9F076F000-0x00007FF9F0770000-memory.dmp

Download

memory/2764-23-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp

Download

memory/2764-24-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp

Download

memory/2764-25-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp

Download

memory/2764-27-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp

Download

memory/2764-20-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp

Download

memory/2764-18-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp

Download