18f675711f7128f6d085199b99ec0c7ebb2243784cc76df62aa7841f10c34f50

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CartethyiaPet/ϣ.vbs
Size 633B
Sample261001-nrccvszfre
SHA256 18f675711f7128f6d085199b99ec0c7ebb2243784cc76df62aa7841f10c34f50
MD5 b38f0023876798f015994c1e75209548
SHA1 2671255340151837559075b55c26972e0184246d
SHA512 71061b4ee3ca36d35275c1a117616e3d35f14dd7628436c7b39abfee4ef0aa8ab581dc506204655bf17e34a0b1b12f10a4f85aab2b503eb09cd00574d6c55f1a
TLSH
T170F0024AD84DD124C65B82F250F3FDAED3374020171083ED18B4A547B54D23DDF4608A
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2204	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	powershell.exe
File opened (read-only)	\??\Z:	powershell.exe
File opened (read-only)	\??\A:	powershell.exe
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\L:	powershell.exe
File opened (read-only)	\??\P:	powershell.exe
File opened (read-only)	\??\W:	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\G:	powershell.exe
File opened (read-only)	\??\H:	powershell.exe
File opened (read-only)	\??\J:	powershell.exe
File opened (read-only)	\??\M:	powershell.exe
File opened (read-only)	\??\N:	powershell.exe
File opened (read-only)	\??\R:	powershell.exe
File opened (read-only)	\??\S:	powershell.exe
File opened (read-only)	\??\E:	powershell.exe
File opened (read-only)	\??\T:	powershell.exe
File opened (read-only)	\??\V:	powershell.exe
File opened (read-only)	\??\X:	powershell.exe
File opened (read-only)	\??\Y:	powershell.exe
File opened (read-only)	\??\O:	powershell.exe
File opened (read-only)	\??\I:	powershell.exe
File opened (read-only)	\??\K:	powershell.exe
File opened (read-only)	\??\Q:	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
708	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	powershell.exe
2204	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeShutdownPrivilege	2204	powershell.exe
Token: SeCreatePagefilePrivilege	2204	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 2204	708	WScript.exe	86
PID 2204 wrote to memory of 3504	2204	powershell.exe	89
PID 3504 wrote to memory of 2904	3504	csc.exe	91

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CartethyiaPet\ϣ.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -STA -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\CartethyiaPet\cartethyia-pet.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t5oprqv5\t5oprqv5.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8632.tmp" "c:\Users\Admin\AppData\Local\Temp\t5oprqv5\CSC62BD2272E12C4025AC2368943A4AF029.TMP"
      4⤵
      PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES8632.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8632.tmp
Size 1KB
SHA256 d040f6239c23ea2d094b21b2977b5cec383e93ac16217eaf0829e924f7496bd8
MD5 5da8769824a4c5a60043e2054b65e71d
SHA1 ab5ecd521fa89c86407f0cf437e2f2c334a1e544
SHA512 81262c8ea631409cba0defe8118d10163edc38952caf8fc79b8bd9598bd32c5f3b055fb32a8b057ee51dfba34b8fb5ca7d438b381c16bd0b9e9cdf0f235a88df
TLSH
T13D21CC0593E9871EF077173169FA172F9238FE94EFA1935F444011691C51204DEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4lbtwtou.1jh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4lbtwtou.1jh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

t5oprqv5.dll

Path C:\Users\Admin\AppData\Local\Temp\t5oprqv5\t5oprqv5.dll
Size 3KB
SHA256 9c2b2c8f645a565d4da918128d5501e8527ca6652ffa989eaa9f484ceaf95ec2
MD5 f7ed796a79352b95f8222f1df3ed0aee
SHA1 81253a9e6b30e1ccdee16b15dccccbc366c15baa
SHA512 aed7922c8def150d196d064871a8b29c89ed9822bb47b7056add39292693ae9c8b748051a26fc057201c0ca5e15de47293d086274aa75b9910d305367f5b1357
TLSH
T10851DF4AA3E8456BF4770735ADF3431777B8F890DB72932E18900259AC217241A31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC62BD2272E12C4025AC2368943A4AF029.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\t5oprqv5\CSC62BD2272E12C4025AC2368943A4AF029.TMP
Size 652B
SHA256 280c64c75946c43b9088aeb35f412c308516f3ec0116656a74c40270523aa4c8
MD5 aecdc6d12a7dfd9ac0c71ecd8092c5e9
SHA1 433f600d2c097e38c5bf9ab825e5a096b6e8becb
SHA512 4def722faf5428e0f8bad069920fb5e921124ac493422af07bfb22b01ff38d1b8ab982965540f9bdc8dd68c766f95e66810d902683ffb75131a3aa9d6225b6eb
TLSH
T10AF05E4A63F8420EF0F35B30BDF64367D1ACBC64DE3293ED1451035D68646248962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

t5oprqv5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\t5oprqv5\t5oprqv5.0.cs
Size 361B
SHA256 57b8be887a023e65d748ecf6e5618e3d7b9a6babd91d250a07119ebd884cd5d5
MD5 3a6f7e47a5efec1ac4390d28d8f0b89e
SHA1 84a50f3d6db9ed7b9ce5cc0774540ede614f1fb1
SHA512 e92497dce6523f2ce6d801dd2dc3cac1c66123be24485a8457fb388df7ed26c1204fc559bac7eb93e6c6b30eb3c5b0c5770b9278659168d857d8d440edaff045
TLSH
T160E0C0146353B7B0803209226C44F6EBF70BC13652BE3801AD7D2B32CF931543438A48
MD5 SHA1 SHA512 TLSH

Submit Download

t5oprqv5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\t5oprqv5\t5oprqv5.cmdline
Size 369B
SHA256 80f6c1bbd2204ca188dad9d542cbd9cd5cff340b76e6a7ed098b7d9bb80da532
MD5 0296d8c4d80ff62c6f79457d21704582
SHA1 f518848dd574f4ec3688c457c3e3881850c5ed3f
SHA512 49b8f681e1b3b42a955406abdd79d558b87c0a4b4602e13312c7749dfba17a504e4c5c07e36651b033c89cc56903c516038f67eb3bba60c592e1c2b2126a720e
TLSH
T1B0E0C62B8386C27D02EE100B326AD4ACD27A2FC3B9803F849040841DE0270022FD27C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2204-1-0x00000203D8E60000-0x00000203D8E70000-memory.dmp

Download

memory/2204-9-0x00000203D8E30000-0x00000203D8E52000-memory.dmp

Download

memory/2204-22-0x00000203C0BD0000-0x00000203C0BD8000-memory.dmp

Download

memory/2204-24-0x00000203D8E60000-0x00000203D8E70000-memory.dmp

Download

memory/2204-0-0x00000203D8E60000-0x00000203D8E70000-memory.dmp

Download

memory/2204-34-0x00000203DC0B0000-0x00000203DC272000-memory.dmp

Download

memory/2204-35-0x00000203DC7B0000-0x00000203DCCD8000-memory.dmp

Download

memory/2204-36-0x00000203D8E60000-0x00000203D8E70000-memory.dmp

Download

memory/2204-37-0x00000203D8E60000-0x00000203D8E70000-memory.dmp

Download

memory/2204-38-0x00000203D8E60000-0x00000203D8E70000-memory.dmp

Download