Analysis
- max time kernel
4s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/05/2026, 14:56
General
- Target script.js
- Size 3KB
- Sample260507-sa3wpse18w
- SHA256 f0b186d7f47c131f3434676e9e87d14cfbea7b3c26ba49d95e2c08b28a5f8510
Malware Config
Signatures
- Clears Windows event logs 1 TTPs 2 IoCs
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 6 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\script.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM procmon.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM procexp.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM wireshark.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM x64dbg.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM vboxservice.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM vmtoolsd.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" cl System2⤵
- Clears Windows event logs
-
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" cl Security2⤵
- Clears Windows event logs
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_l5oq2shs.yki.ps1
memory/3336-19-0x000001864F5C0000-0x000001864F5DC000-memory.dmp
memory/3336-21-0x000001864F5E0000-0x000001864F5FA000-memory.dmp
memory/3336-8-0x0000018636E70000-0x0000018636E80000-memory.dmp
memory/3336-9-0x00007FF4E51B0000-0x00007FF4E51C0000-memory.dmp
memory/3336-16-0x0000018636F30000-0x0000018636F4C000-memory.dmp
memory/3336-17-0x000001864F260000-0x000001864F313000-memory.dmp
memory/3336-1-0x0000018636E80000-0x0000018636EA2000-memory.dmp
memory/3336-18-0x000001864F420000-0x000001864F42A000-memory.dmp
memory/3336-20-0x000001864F430000-0x000001864F43A000-memory.dmp
memory/3336-0-0x0000018636E70000-0x0000018636E80000-memory.dmp
memory/3336-22-0x000001864F5A0000-0x000001864F5A8000-memory.dmp
memory/3336-23-0x000001864F5B0000-0x000001864F5B6000-memory.dmp
memory/3336-24-0x000001864FA00000-0x000001864FA0A000-memory.dmp
memory/3336-25-0x0000018636E70000-0x0000018636E80000-memory.dmp
memory/3336-29-0x0000018636E20000-0x0000018636E32000-memory.dmp
memory/3336-28-0x0000018635070000-0x000001863507C000-memory.dmp