loader.vbs

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 28, 2025, 9:28 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\win_init.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\win_init.exe		0	0

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

Skyhigh	BehavesLike.VBS.Dropper.xp
Symantec	ISB.Downloader!gen60
ESET-NOD32	VBS/TrojanDownloader.Agent.PHZ
Kaspersky	HEUR:Trojan-Downloader.Script.Generic
NANO-Antivirus	Trojan.Script.Vbs-heuristic.druvzi
Ikarus	Trojan-Downloader.VBS.Agent
Google	Detected
Yandex	HTML.Psyme.Gen
Fortinet	VBS/Agent.RNN!tr.dldr

Wscript.exe initiated network communications indicative of a script based payload download (4 events)

Time & API	Arguments	Status	Return	Repeated
WSASend March 28, 2025, 9:28 a.m.	buffer:  m i gåí-+H‰R沝‘ÒÞÈ n¦ÕÏßÀ/sjÿ/5 ÀÀÀ À 28 (ÿ  github.com  socket: 532		0	0
WSASend March 28, 2025, 9:28 a.m.	buffer: 5 1gåí-ý¶Þÿ`ÈÚ9î¿À]ší‡°C Š×"­ÛÁc  ÿ socket: 532		0	0
InternetCrackUrlW March 28, 2025, 9:28 a.m.	url: https://ntfy.sh/dillertus77 flags: 0	1	1	0
HttpOpenRequestW March 28, 2025, 9:28 a.m.	connect_handle: 0x00cc0008 http_version: flags: 81788928 http_method: POST referer: path: /dillertus77	1	13369356	0

wscript.exe-based dropper (JScript, VBS) (1 event)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (14 events)

Time & API	Arguments	Status	Return	Repeated
WSASend March 28, 2025, 9:28 a.m.	buffer:  m i gåí-+H‰R沝‘ÒÞÈ n¦ÕÏßÀ/sjÿ/5 ÀÀÀ À 28 (ÿ  github.com  socket: 532		0	0
WSASend March 28, 2025, 9:28 a.m.	buffer: 5 1gåí-ý¶Þÿ`ÈÚ9î¿À]ší‡°C Š×"­ÛÁc  ÿ socket: 532		0	0
InternetCrackUrlW March 28, 2025, 9:28 a.m.	url: https://ntfy.sh/dillertus77 flags: 0	1	1	0
HttpOpenRequestW March 28, 2025, 9:28 a.m.	connect_handle: 0x00cc0008 http_version: flags: 81788928 http_method: POST referer: path: /dillertus77	1	13369356	0
send March 28, 2025, 9:28 a.m.	buffer: ! socket: 1216 sent: 1	1	1	0
send March 28, 2025, 9:28 a.m.	buffer:  j f gåí.DÒN‚‚Ò±,~f֙ø™ãƒù<¢ ¦È@¤;ÿø/5 ÀÀÀ À 28 %ÿ  ntfy.sh  socket: 1304 sent: 111	1	111	0
send March 28, 2025, 9:28 a.m.	buffer: ! socket: 1216 sent: 1	1	1	0
send March 28, 2025, 9:28 a.m.	buffer: ! socket: 1216 sent: 1	1	1	0
send March 28, 2025, 9:28 a.m.	buffer:  j f gåí/¼k¬¤á0SL«_Pg¶(ñÑf¬³°²ÊâÝ/5 ÀÀÀ À 28 %ÿ  ntfy.sh  socket: 1304 sent: 111	1	111	0
send March 28, 2025, 9:28 a.m.	buffer: ! socket: 1216 sent: 1	1	1	0
send March 28, 2025, 9:28 a.m.	buffer: ! socket: 1216 sent: 1	1	1	0
send March 28, 2025, 9:28 a.m.	buffer: 5 1gåí/ÐÊ)õp+_!Ïgp™l.¶¡ZôÒùz  ÿ socket: 1304 sent: 58	1	58	0
send March 28, 2025, 9:28 a.m.	buffer: ! socket: 1216 sent: 1	1	1	0
send March 28, 2025, 9:28 a.m.	buffer: ! socket: 1216 sent: 1	1	1	0

One or more non-whitelisted processes were created (1 event)

parent_process

wscript.exe

martian_process

C:\Users\test22\AppData\Local\Temp\win_init.exe

The process wscript.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Users\test22\AppData\Local\Temp\win_init.exe