a53381261bd5c194db1ffb7ab1315ad8f330113e610f35547db0cc77e47e2153

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.js
Size 37KB
Sample260426-tycvvsa121
SHA256 a53381261bd5c194db1ffb7ab1315ad8f330113e610f35547db0cc77e47e2153
MD5 d3e36812728658cf03e893903a8756fd
SHA1 0f8f7834f84132636710bb0e9b7f910312852339
SHA512 b70cb97673c3744788728d7b536e78498d4a8a30325e57695e9305abec329d96d9bdb2f405d53238caeebdb21160e7c8e8575aec735d29e4c1b99787db50a1af
SSDEEP 384:i7nySMZFEDaXbe8NzgbNhiKy1WtTiUAuvlfpND9pDrAp25+EFbv:VKHtT3A4lfpND99rSGLFL
TLSH
T1B7032CACEDEB261F61B28DF2A9F56147A02933FBA21E5BDD008683F4175350DE468D0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Network.js	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Network.js	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1464	2024	wscript.exe	85

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Setup.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main.bat" "
  2⤵
  - Drops startup file
  PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

main.bat

Path C:\Users\Admin\AppData\Local\Temp\main.bat
Size 146B
SHA256 93c41277515b771294085c944c1d36ea2ed2f5d61b229458a0aaee37eca55722
MD5 fbaa0858e6aec20cfac68953264e218c
SHA1 dcd56c97a12f9d3fd0a33cab2a6090809c295618
SHA512 ca70c7a8b4dc7ef9c0c272b09070005d16aecfb79181891b3bf2dde9df269f8a13928daf1a1b82e8b54681cfff8c023b6b95462c54a153d49aa51bf320314c26
TLSH
T18EC02B7581A1C10BF8133A8307FF530CC0E08AD677C66B320118060D774150DF09A003
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2024-7-0x000002D437AD0000-0x000002D437ADC000-memory.dmp

Download

memory/2024-6-0x000002D439760000-0x000002D439809000-memory.dmp