a7937c1d521825e89a8fdc26146292370c73bbd39d04b0ca79d07589a4a0a972

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New-order12435735.vbs
Size 63KB
Sample261007-wlk2tadx2n
SHA256 a7937c1d521825e89a8fdc26146292370c73bbd39d04b0ca79d07589a4a0a972
MD5 0567f9a6e5bdaf84d5bb298de2bc9381
SHA1 3fa26c6fcac7a2796f0835086eee5e8517a8d728
SHA512 8b591d7dce8befeda8c1db8ba4797b33e8bf69090bd543f5747875867fea8138c1f46f1e7850648c6b3c465851d9c28dcb94138fcc4a44920458251d3658f24e
SSDEEP 768:UngkuriIp2yVzBVwnodYfFjONniCNNLM4IU/S298/7jG1e+Q1hMsbjR9OnRvaebj:UngkodCZN6hI//CWrOnRCKwmW4yWQ4F
TLSH
T131532AB0EDA809555D8A32B7F9063D9C89B8918D033324A4FF981B5A580757CEBFF10E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 15 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4504	powershell.exe
8	4504	powershell.exe
9	4504	powershell.exe
10	4504	powershell.exe
11	4504	powershell.exe
13	4504	powershell.exe
14	4504	powershell.exe
15	4504	powershell.exe
16	4504	powershell.exe
17	4504	powershell.exe
18	4504	powershell.exe
19	4504	powershell.exe
20	4504	powershell.exe
21	4504	powershell.exe
22	4504	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4888	WScript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4504	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4504	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 5456	4888	WScript.exe	89
PID 5456 wrote to memory of 3224	5456	cmd.exe	91
PID 5456 wrote to memory of 4504	5456	cmd.exe	92
PID 4504 wrote to memory of 3220	4504	powershell.exe	94
PID 4504 wrote to memory of 3448	4504	powershell.exe	95
PID 4504 wrote to memory of 3448	4504	powershell.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\New-order12435735.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /v:on /c echo ^%Bevidstlsheden^% | !Blokdannelser! -
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo %Bevidstlsheden% "
    3⤵
    PID:3224
- - \??\c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -
    3⤵
    - Badlisted process makes network request
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\SysWOW64\backgroundtaskhost.exe
      "C:\Windows\SysWOW64\backgroundtaskhost.exe"
      4⤵
      PID:3220
  - - C:\Windows\SysWOW64\backgroundtaskhost.exe
      "C:\Windows\SysWOW64\backgroundtaskhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Debugger Evasion

T1622

Process Injection

T1055

Credential Access

Discovery

Debugger Evasion

T1622

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4504-0-0x0000000074912000-0x0000000074913000-memory.dmp

Download

memory/4504-1-0x0000000002650000-0x0000000002686000-memory.dmp

Download

memory/4504-2-0x0000000074900000-0x00000000750BC000-memory.dmp

Download

memory/4504-4-0x0000000074900000-0x00000000750BC000-memory.dmp

Download

memory/4504-3-0x0000000005410000-0x0000000005A5A000-memory.dmp

Download

memory/4504-6-0x0000000005180000-0x00000000051E6000-memory.dmp

Download

memory/4504-7-0x00000000051F0000-0x0000000005256000-memory.dmp

Download

memory/4504-5-0x00000000050E0000-0x0000000005102000-memory.dmp

Download

memory/4504-10-0x0000000005A60000-0x0000000005DBB000-memory.dmp

Download

memory/4504-11-0x0000000005E90000-0x0000000005EAE000-memory.dmp

Download

memory/4504-12-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

Download

memory/4504-13-0x0000000006E70000-0x0000000006EB8000-memory.dmp

Download

memory/4504-16-0x0000000007320000-0x0000000007342000-memory.dmp

Download

memory/4504-15-0x0000000007210000-0x000000000722A000-memory.dmp

Download

memory/4504-17-0x0000000007910000-0x0000000007ECA000-memory.dmp

Download

memory/4504-14-0x0000000007280000-0x0000000007316000-memory.dmp

Download

memory/4504-18-0x0000000008550000-0x0000000008BCC000-memory.dmp

Download

memory/4504-20-0x0000000074900000-0x00000000750BC000-memory.dmp

Download

memory/4504-19-0x0000000074912000-0x0000000074913000-memory.dmp

Download

memory/4504-21-0x0000000074900000-0x00000000750BC000-memory.dmp

Download

memory/4504-23-0x0000000074900000-0x00000000750BC000-memory.dmp

Download

memory/4504-24-0x0000000074900000-0x00000000750BC000-memory.dmp

Download

memory/4504-25-0x0000000074900000-0x00000000750BC000-memory.dmp

Download

memory/4504-26-0x0000000074900000-0x00000000750BC000-memory.dmp

Download

memory/4504-27-0x0000000008BD0000-0x000000000AF2E000-memory.dmp

Download

memory/4504-28-0x0000000074900000-0x00000000750BC000-memory.dmp

Download