Analysis
- max time kernel
299s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 09:13
General
- Target Bill of Quantity - RFQ SUPPORTING DOCUMENT.js
- Size 1.4MB
- Sample261020-k68stsfx4v
- SHA256 8ba50aa5ff6d7653d79b9bdef6dd662bbae2ce3799a910d224be3384e72e9942
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Bill of Quantity - RFQ SUPPORTING DOCUMENT.js"1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\esjfwloomk\w11766.ps1"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vfwktzgd\vfwktzgd.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES28AC.tmp" "c:\Users\Admin\AppData\Local\Temp\vfwktzgd\CSC7B836998A6F9451D862A6CAB6A1BD57.TMP"3⤵
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES28AC.tmp
w11766.ps1
vfwktzgd.dll
CSC7B836998A6F9451D862A6CAB6A1BD57.TMP
vfwktzgd.0.cs
vfwktzgd.cmdline
memory/1916-8-0x0000000006120000-0x0000000006186000-memory.dmp
memory/1916-4-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/1916-12-0x0000000006270000-0x00000000065CB000-memory.dmp
memory/1916-13-0x00000000066D0000-0x00000000066EE000-memory.dmp
memory/1916-14-0x0000000006710000-0x000000000675C000-memory.dmp
memory/1916-2-0x0000000074F22000-0x0000000074F23000-memory.dmp
memory/1916-16-0x0000000007CF0000-0x000000000836C000-memory.dmp
memory/1916-17-0x0000000006C80000-0x0000000006C9A000-memory.dmp
memory/1916-7-0x0000000005F60000-0x0000000005F82000-memory.dmp
memory/1916-6-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/1916-5-0x0000000005890000-0x0000000005EDA000-memory.dmp
memory/1916-9-0x0000000006200000-0x0000000006266000-memory.dmp
memory/1916-3-0x0000000005200000-0x0000000005236000-memory.dmp
memory/1916-30-0x0000000007670000-0x0000000007678000-memory.dmp
memory/1916-31-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/1916-32-0x0000000007A80000-0x0000000007A9A000-memory.dmp
memory/1916-33-0x0000000074F22000-0x0000000074F23000-memory.dmp
memory/1916-34-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/1916-35-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/1916-36-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/1916-39-0x0000000074F10000-0x00000000756CC000-memory.dmp