cbf209c6bd98f98216c3c1f6f82956cf85ac1f7841e3d9212382a7d56d04bd9e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 01:24

Target
tmp6ag3z8co.js
Size 99KB
Sample260523-bscc2aat2q
SHA256 cbf209c6bd98f98216c3c1f6f82956cf85ac1f7841e3d9212382a7d56d04bd9e
MD5 d9fa849295c06371b5f08a9e5fcff97b
SHA1 26ed9974e2113bd905fa1a7bded9da77cc88e53f
SHA512 2af998b5994e81c7a5575497423337d39f9ec2f1e6aec54b736748ba1f144a01cdcc958f056320acafa13abe1bb5d675a6767c8d5ce504670b77cf619b465716
SSDEEP 3072:OT6fPJptwTmqAz7vcHk2CzlZR4GRricgg54oRuyrrP9pn19e6msCLP/:y6fPJptwqqAzsk2CzlZR4GRricgg54o6
TLSH
T11FA376883FC6F07193657433692FA0EEF27E0C91760C8196DAA760D4BE5CB18E2B595C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmp6ag3z8co.js
1⤵
- Badlisted process makes network request
PID:2716

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact