Analysis
- user interaction
yes - max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 03:52
Static task
static1
Behavioral task
behavioral1
Sample
FUGASA_RFQ_Attachment_Items_List_and_Specifications_for_Quotation_Request_1410-26.xlsx.vhdx
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
FUGASA_RFQ_Attachment_Items_List_and_Specifications_for_Quotation_Request_1410-26.xlsx.vhdx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target FUGASA_RFQ_Attachment_Items_List_and_Specifications_for_Quotation_Request_1410-26.xlsx.vhdx
- Size 14.0MB
- Sample261030-efcptag13x
- SHA256 a8e8777346113199e0b2fec681d9f6516baaaa047e009eef2d7f2194099d823d
- MD5 32b7eb157673771ce6d83e00d13acc9f
- SHA1 e411f4feebc1ea6122c0cb785fb8c0b49d7041f8
- SHA512 759172789f4f36780d0e95d0b879c5b6738b5db7f148beb250b1a5ca9a398c08af4d1c7a0299c64b6606a8ac6b5e6aaa6620a8084c10d58412d5eee6c160882c
- SSDEEP 24576:KbH/vN93BAA9Bu1Bzx+zan0L9zLEaTBSBs:Kb/VYHs
- TLSH T198E6CE5603896A78F54D8F709D6F225630F1DE6CB5240A408BB77BB37C3B9D650388AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2832 1780 powershell.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2732 1780 powershell.exe 96 - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 2832 powershell.exe 2732 powershell.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2832 set thread context of 4076 2832 powershell.exe 103 PID 2732 set thread context of 3012 2732 powershell.exe 104 - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5064 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WScript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WScript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WScript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WScript.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings cmd.exe - NTFS ADS 8 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\[SYSTEM]\$UpCase:$Info 7zG.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\[SYSTEM]\$UpCase:$Info 7zG.exe File created C:\Users\Admin\AppData\Local\Temp\[SYSTEM]\$Extend\$RmMetadata\$Repair:$Config 7zG.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\[SYSTEM]\$Extend\$RmMetadata\$Repair:$Config 7zG.exe File created C:\Users\Admin\AppData\Local\Temp\[SYSTEM]\$Extend\$RmMetadata\$TxfLog\$Tops:$T 7zG.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\[SYSTEM]\$Extend\$RmMetadata\$TxfLog\$Tops:$T 7zG.exe File created C:\Users\Admin\AppData\Local\Temp\[SYSTEM]\$Secure:$SDS 7zG.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\[SYSTEM]\$Secure:$SDS 7zG.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2832 powershell.exe 2832 powershell.exe 2832 powershell.exe 2732 powershell.exe 2732 powershell.exe 2732 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 4148 7zG.exe Token: 35 4148 7zG.exe Token: SeSecurityPrivilege 4148 7zG.exe Token: SeSecurityPrivilege 4148 7zG.exe Token: SeDebugPrivilege 2832 powershell.exe Token: SeIncreaseQuotaPrivilege 2832 powershell.exe Token: SeSecurityPrivilege 2832 powershell.exe Token: SeTakeOwnershipPrivilege 2832 powershell.exe Token: SeLoadDriverPrivilege 2832 powershell.exe Token: SeSystemProfilePrivilege 2832 powershell.exe Token: SeSystemtimePrivilege 2832 powershell.exe Token: SeProfSingleProcessPrivilege 2832 powershell.exe Token: SeIncBasePriorityPrivilege 2832 powershell.exe Token: SeCreatePagefilePrivilege 2832 powershell.exe Token: SeBackupPrivilege 2832 powershell.exe Token: SeRestorePrivilege 2832 powershell.exe Token: SeShutdownPrivilege 2832 powershell.exe Token: SeDebugPrivilege 2832 powershell.exe Token: SeSystemEnvironmentPrivilege 2832 powershell.exe Token: SeRemoteShutdownPrivilege 2832 powershell.exe Token: SeUndockPrivilege 2832 powershell.exe Token: SeManageVolumePrivilege 2832 powershell.exe Token: 33 2832 powershell.exe Token: 34 2832 powershell.exe Token: 35 2832 powershell.exe Token: 36 2832 powershell.exe Token: SeIncreaseQuotaPrivilege 2832 powershell.exe Token: SeSecurityPrivilege 2832 powershell.exe Token: SeTakeOwnershipPrivilege 2832 powershell.exe Token: SeLoadDriverPrivilege 2832 powershell.exe Token: SeSystemProfilePrivilege 2832 powershell.exe Token: SeSystemtimePrivilege 2832 powershell.exe Token: SeProfSingleProcessPrivilege 2832 powershell.exe Token: SeIncBasePriorityPrivilege 2832 powershell.exe Token: SeCreatePagefilePrivilege 2832 powershell.exe Token: SeBackupPrivilege 2832 powershell.exe Token: SeRestorePrivilege 2832 powershell.exe Token: SeShutdownPrivilege 2832 powershell.exe Token: SeDebugPrivilege 2832 powershell.exe Token: SeSystemEnvironmentPrivilege 2832 powershell.exe Token: SeRemoteShutdownPrivilege 2832 powershell.exe Token: SeUndockPrivilege 2832 powershell.exe Token: SeManageVolumePrivilege 2832 powershell.exe Token: 33 2832 powershell.exe Token: 34 2832 powershell.exe Token: 35 2832 powershell.exe Token: 36 2832 powershell.exe Token: SeIncreaseQuotaPrivilege 2832 powershell.exe Token: SeSecurityPrivilege 2832 powershell.exe Token: SeTakeOwnershipPrivilege 2832 powershell.exe Token: SeLoadDriverPrivilege 2832 powershell.exe Token: SeSystemProfilePrivilege 2832 powershell.exe Token: SeSystemtimePrivilege 2832 powershell.exe Token: SeProfSingleProcessPrivilege 2832 powershell.exe Token: SeIncBasePriorityPrivilege 2832 powershell.exe Token: SeCreatePagefilePrivilege 2832 powershell.exe Token: SeBackupPrivilege 2832 powershell.exe Token: SeRestorePrivilege 2832 powershell.exe Token: SeShutdownPrivilege 2832 powershell.exe Token: SeDebugPrivilege 2832 powershell.exe Token: SeSystemEnvironmentPrivilege 2832 powershell.exe Token: SeRemoteShutdownPrivilege 2832 powershell.exe Token: SeUndockPrivilege 2832 powershell.exe Token: SeManageVolumePrivilege 2832 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4148 7zG.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2832 wrote to memory of 4076 2832 powershell.exe 103 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 PID 2732 wrote to memory of 3012 2732 powershell.exe 104 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FUGASA_RFQ_Attachment_Items_List_and_Specifications_for_Quotation_Request_1410-26.xlsx.vhdx1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:5064
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1184
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap29024:254:7zEvent88691⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4148
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FUGASA_RFQ_Attachment_Items_List_and_Specifications_for_Quotation_Request_1410-26.xlsx.js"1⤵
- Reads the TCP/IP host and domain name from the registry
PID:2728
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FUGASA_RFQ_Attachment_Items_List_and_Specifications_for_Quotation_Request_1410-26.xlsx.js"1⤵
- Reads the TCP/IP host and domain name from the registry
PID:2880
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\48277.ps1"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵PID:4076
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵PID:1768
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\97947.ps1"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵PID:3012
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
- Size 67KB
- SHA256 e52cbc6b7db32862413f017d28c07ac7fa2c445958227cc9a5719db38cb27286
- MD5 db06a60e00735fdb1ca8b5629430d59b
- SHA1 497af780fc8610d658f7318c30e0bcb239f291e6
- SHA512 446c480652a93fd2a651c77289c912f4251daf2cf58f4aab26c79edf3e34bc9de52f5f8b866eda76882a487a55399687d1c4953eabc351378e4f827170857e73
- SSDEEP 1536:iKLge7Yo2hk3MTfKQ1PflJdpHYLh4iUxpR40i71YigMJyPTOdB4V3CNBQkj2Ra5c:iKLge7Yo2hk3MTfKQ1PflJd9YLqiUpRf
- TLSH T127636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 beca74fa3ad0f363fcaee93e664ffaa4217c2c3ccc2c3b72ec71833805df3534
- MD5 bb46c4bb827200a6cfe9043d73363091
- SHA1 253f138fad598bb4d5d0ada32f9eeaa8b4952dff
- SHA512 f64d73a74dd7ff4d34f15481b992a4d9fc97a45f14b96c6d2e612d4f06ee55e764b3720a4bfad7844242cbcc13882b173341465621f95af452408a2235f8a7ae
- TLSH T1C1314637F3DC8695C89A413A209DAC1036B7C3CB409EDFDB6B84D255A52F698CE61560
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\48277.ps1
- Size 3.7MB
- SHA256 8abb50267566a333880b82117d085a5c3aa816b0b144a1cc9912564bb5e6e4b2
- MD5 bdfefcd9f7455d7cf3b31d9f52bf2d9a
- SHA1 3bb777ce9101a517c8485bf1cdef2cc528c87bbf
- SHA512 21a23f6f0d80428530003e995f4e51b3c0407864d16ce148cba98a698aa2ac7efc24b4ead99e0d62f8964842447f9a3495266d2827abeab3a70f729f8f34a941
- SSDEEP 3072:Y4x23YA+c4m+F35jxv82G02HSQmUxqdnIK1dQaEeLau6hLE7+qiOOcp3LuDKBc9d:GN
- TLSH T11B06573DDF29163FC2B7CE2CC9CA5A07F895091B331CED8AA4D763665623243B49215E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\FUGASA_RFQ_Attachment_Items_List_and_Specifications_for_Quotation_Request_1410-26.xlsx.js
- Size 2.0MB
- SHA256 aa56773742d689ec4c789267f6fab7bd2397d15e1014df9da35b706337b1ac5d
- MD5 af0315dbf6f933a504a51cc95f19eee0
- SHA1 e8d6e9ec41cf8cf79db93cbf4737925ef1216e51
- SHA512 ef96c1dc0458fdc0cb76f036de10405a24709e0847deb2847ff83f9671c35158e2878fcac130445d8ef1dd26a6ea80db1737d311c1ad66982ce1056b5fdecf49
- SSDEEP 12288:WNkAfm93NXOXVHA9Bu82DBzx+zan0L9zLEaTBSBsY:h93BAA9Bu1Bzx+zan0L9zLEaTBSBsY
- TLSH T1E4A58E5A03896B78F54D8F509D6F225B30F1966DB5240A40CBB76BB37C3B8D6503C8AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\[SYSTEM]\$MFT
- Size 256KB
- SHA256 d219bc28e051ff9233e74e6c8d0ff59d83bb7e772fc94cf7394e627319177b44
- MD5 4996190f1881d38c13d8681b6963191f
- SHA1 794fd355f09555e71a7e0b4bb91b701cd2a0d7ec
- SHA512 b9aeb63d2d47c4748638ee10650a47aad81b8c87f867f5e738fb6f047b7d85ea38348ea5e18a8c9b680592cde7ed595b3b01bbb5f39f625732397323adb0839c
- SSDEEP 96:4DdxKO/+UJrjf7nE3YyMZJiDomDm00tHxM9000LqujQQM:gxJ/+cjf7n6YyMSNm00lS9000muk
- TLSH T152442683B3B78F26D23F57358A9B0326F775F19D5B9297071648932A4EA22C04E32D71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_544bfe1v.101.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH