c0c6d90a469fe79f03c570f7d2a6485b2ccd7ee890b5ec3bf04380e8c8d55739

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_c0c6d90a469fe79f03c570f7d2a6485b2ccd7ee890b5ec3bf04380e8c8d55739.js
Size 76KB
Sample260508-mvhtdabs2j
SHA256 c0c6d90a469fe79f03c570f7d2a6485b2ccd7ee890b5ec3bf04380e8c8d55739
MD5 caacc18870f071fdafa0ce3fe0f18e0b
SHA1 3edca3ebe0662ee48f146769e7c2b12278c73fca
SHA512 eb5c3ff497a43f7bf69934eb6fdff80976f9653701b82ef41b10589cd5f3329f88d1eb943d21de22144a7f1043a23d2cacef41513f5985fb8c303e70b774bca6
SSDEEP 1536:xwjvr8P7k3vH9BctadF66wWYuGo1NjEtpws7/qXbpESGoXwMvbCj5t:CjweQIFbYFo3EtpwESiSZzvbCj5t
TLSH
T19A73C8C839CAF4A6039270B7992BA057F1ED8C80B80CC555FDD5645DB8AC704EAB6B7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2828	wscript.exe
3	2828	wscript.exe
4	2828	wscript.exe
5	2828	wscript.exe
6	2828	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\_c0c6d90a469fe79f03c570f7d2a6485b2ccd7ee890b5ec3bf04380e8c8d55739.js
1⤵
- Badlisted process makes network request
PID:2828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2828-0-0x0000027059790000-0x00000270597FF000-memory.dmp

Download