Overview

overview

7

Static

static

1

ORDER#0210...DF.vbs

windows10-2004-x64

7

ORDER#0210...DF.vbs

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 12:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ORDER#02102026-79065.PDF.vbs
  • Size 812KB
  • Sample261002-pk65bswtfx
  • SHA256 3346fb7e363282a6929b62deb57a133f6143811eefd9d58010bef3836abe02f4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Executes a file named after a Windows system binary 1 TTPs 2 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ORDER#02102026-79065.PDF.vbs"
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\qSgj.vbs"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\write.js"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3344
        • C:\Users\Admin\AppData\Local\Temp\write.exe
          "C:\Users\Admin\AppData\Local\Temp\write.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1880
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\audio.js"
        3⤵
        • Executes a file named after a Windows system binary
        • Suspicious use of WriteProcessMemory
        PID:1124
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          4⤵
          • Executes a file named after a Windows system binary
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1596

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        audio.js
        • Path C:\Users\Admin\AppData\Local\Temp\audio.js
        • Size 374KB
        • SHA256 9c2655dd8ff03246a0ee7aef7348f5ce4b86f41ce7b364134de645d42d778636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qSgj.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\qSgj.vbs
        • Size 600KB
        • SHA256 3a0f758862d6bbd61b767d63ecb8951573ac6bfc655a1bee6730f9a6152db758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.exe
        • Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
        • Size 280KB
        • SHA256 140a2b7ff0068183429a3e7783623394f82ee2a9d0f725beedce6c54430524a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        write.exe
        • Path C:\Users\Admin\AppData\Local\Temp\write.exe
        • Size 9KB
        • SHA256 45bd87a5803916409a0d824beefafb1faf49d52e0ba9c0e8014e82eaa17e7659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        write.js
        • Path C:\Users\Admin\AppData\Local\Temp\write.js
        • Size 12KB
        • SHA256 048b2735a7741288164eaac5eb4ccbb3d2a62b97a47fad688b74061d38260091
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download