95eeb49d62b30ad2b74bc710977cbb7091b5009bc59a3b59592a82bcf859aa4e

Analysis

max time kernel
299s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EJM1764445723.js
Size 8KB
Sample260504-ae896sat7s
SHA256 95eeb49d62b30ad2b74bc710977cbb7091b5009bc59a3b59592a82bcf859aa4e
MD5 da90b4e306bdbb85e636a18114ee7fbd
SHA1 061af9d5303a89acbc463e22c6abf54153e55b81
SHA512 bf013bf0790408f2534f6be9db094165b688af3b06bb0901e09f235040c04e8b27da4c0eaec2c1f6e1cc288a8be13f8e5166fa7fc3a40944aa7e30f0ce0cf494
SSDEEP 192:ZUCeW96G6g1ZY1iIIoLnIAfUIBz0vjyDQMUZcruBQboYL:ChBIwiIIoLn9UIBovODwtcL
TLSH
T1FA02A71E66461E37CEF7379A7CDB0D4885BC440363045095793E1EA817A9A2852BBFAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4964	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\EJM1764445723.js
1⤵
- Badlisted process makes network request
PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4964-1-0x000001D9D22D0000-0x000001D9D233F000-memory.dmp

Download

memory/4964-0-0x000001D9D1DB0000-0x000001D9D1DBC000-memory.dmp