03e9edb515412195e54b9547d0549f05fe31c25180cf82b7b3ba7872d44daf3f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SWIFT_COPY (79).js
Size 253KB
Sample260424-l2evmaft6q
SHA256 03e9edb515412195e54b9547d0549f05fe31c25180cf82b7b3ba7872d44daf3f
MD5 3c75688ea3b6dac189040fe40c2b5704
SHA1 ffcd289fdfbdd522bb10b5b9f9dd47fd0904f15f
SHA512 8b48bb710eaa405d21f423ad0e5bd00c21d7219d1cd12b15b6936f11132b8c68854b7cb2437d849cd840fc6fac7252f97c852408d136d6f05f49598a4c0c6670
SSDEEP 6144:j+fJYmFeRMC/qlmfNUfXX4DIA2L2p164ENB+ASJhk:jCevqlONUfH4DIA2L2p1SNB+ASJa
TLSH
T1F9443A243EFA5019B273AF559FE475E68E2FBB633B16942E1090034A4723E40DDD273A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	396	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5616	netsh.exe
2840	netsh.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\RealtonesAustriaEntrepreneursGratitude\\CreaturesPediatricCollectibles.js\""	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
396	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2948	cmd.exe
464	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	regasm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	regasm.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
396	powershell.exe
396	powershell.exe
5140	regasm.exe
5140	regasm.exe
5140	regasm.exe
5140	regasm.exe
5140	regasm.exe
5140	regasm.exe
5140	regasm.exe
5140	regasm.exe
5140	regasm.exe
5140	regasm.exe
5140	regasm.exe
5140	regasm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	5140	regasm.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 3256	2780	wscript.exe	79
PID 3256 wrote to memory of 396	3256	conhost.exe	80
PID 396 wrote to memory of 5140	396	powershell.exe	81
PID 396 wrote to memory of 5140	396	powershell.exe	81
PID 396 wrote to memory of 5140	396	powershell.exe	81
PID 396 wrote to memory of 5140	396	powershell.exe	81
PID 396 wrote to memory of 5140	396	powershell.exe	81
PID 396 wrote to memory of 5140	396	powershell.exe	81
PID 396 wrote to memory of 5140	396	powershell.exe	81
PID 396 wrote to memory of 5140	396	powershell.exe	81
PID 396 wrote to memory of 5140	396	powershell.exe	81
PID 396 wrote to memory of 5140	396	powershell.exe	81
PID 5140 wrote to memory of 5616	5140	regasm.exe	82
PID 5140 wrote to memory of 2840	5140	regasm.exe	84
PID 5140 wrote to memory of 2948	5140	regasm.exe	86
PID 2948 wrote to memory of 5896	2948	cmd.exe	88
PID 2948 wrote to memory of 464	2948	cmd.exe	89

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\SWIFT_COPY (79).js"
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless powershell.exe -W H -noP -NoNi -EP ByPASS -Command "iex $env:6txBWTXfvSty"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -W H -noP -NoNi -EP ByPASS -Command "iex $env:6txBWTXfvSty"
    3⤵
    - Badlisted process makes network request
    - Registers new Windows logon scripts automatically executed at logon.
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
      4⤵
      Accesses Microsoft Outlook profiles
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:5140
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Windows Update Service" dir=out action=allow program="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5616
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Windows Update Service Host" dir=in action=allow program="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2840
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\wifi_profiles.tmp"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5896
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_os4c0cta.t2q.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_os4c0cta.t2q.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rsql_5140_240651515.tmp

Path C:\Users\Admin\AppData\Local\Temp\rsql_5140_240651515.tmp
Size 138KB
SHA256 06a51994d99bb1fab217c1445d1c67c3c1e351493aeb9ee5c85b73f421117a5c
MD5 039254d055c29cf77592c602edfd85ea
SHA1 ef8089a6d7405a9d91188755192bca1f1e96500a
SHA512 32c24f3400f73651d9ec79da711713b7b4a72002ea85fd89d7d47ec07b54477d880fb674d8d5002fde453e3e0de25643d9b953f34062f19454f17aaa5fb031fa
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O5xdVumfnKa:FnbZeMrv/hGt5xhnKa
TLSH
T1B4D3774B3A743002EDE59A722CF055BB5D3C716D8F11A5D428B620688EF2963B63D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rsql_5140_240651531.tmp

Path C:\Users\Admin\AppData\Local\Temp\rsql_5140_240651531.tmp
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wifi_profiles.tmp

Path C:\Users\Admin\AppData\Local\Temp\wifi_profiles.tmp
Size 59B
SHA256 6b6dd8b11f84fb78e3e8cfaa7c5fca569d79402b9fc5861b00960b25607c911e
MD5 409930721dbce1ee58227d109cca4570
SHA1 767f86ffec769d8415f07b4372a108cba1bf7221
SHA512 4875187fce9545a92df636e384f92dcb403dfe80f3cad4a68e79329a1f42e12e9d04948f2a52b939638481da6d3e3b5f5096fe6dfd674ee53cca7c655ec03f17
TLSH
T148A0028672E285B501922A03C6D590731F9411FD4065DF2915DC204256C942DAF15C15
MD5 SHA1 SHA512 TLSH

Submit Download

memory/396-25-0x000002103F140000-0x000002103F149000-memory.dmp

Download

memory/396-11-0x000002103F0C0000-0x000002103F0CE000-memory.dmp

Download

memory/396-10-0x000002103F0F0000-0x000002103F132000-memory.dmp

Download

memory/396-24-0x000002103EDD0000-0x000002103EDE2000-memory.dmp

Download

memory/396-23-0x0000021024D80000-0x0000021024DDD000-memory.dmp

Download

memory/396-8-0x000002103EE20000-0x000002103EE42000-memory.dmp

Download

memory/396-2-0x000002103EEB0000-0x000002103EEC0000-memory.dmp

Download

memory/396-1-0x000002103EEB0000-0x000002103EEC0000-memory.dmp

Download

memory/2780-0-0x000001CD760A0000-0x000001CD760FD000-memory.dmp

Download

memory/5140-48-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-55-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-18-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-27-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-26-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-29-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-30-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-31-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-32-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-33-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-35-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-36-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-34-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-37-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-20-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-40-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-41-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-42-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-43-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-45-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-44-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-46-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-47-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-21-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-49-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-51-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-52-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-53-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-54-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-16-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-56-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-58-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-59-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-60-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-62-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-64-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-66-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-68-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-70-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-72-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-75-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-77-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-80-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-82-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-81-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-79-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-78-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-76-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-74-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-73-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-71-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-69-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-67-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-65-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-15-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-14-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-63-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-61-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-57-0x0000000140000000-0x0000000140576000-memory.dmp

Download

memory/5140-50-0x0000000140000000-0x0000000140576000-memory.dmp

Download