b5a957a066a2d434bcafadbc85f5d027bd0ddfa6236755b48cfb1d7b52157201

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpwl2far7t.js
Size 7.7MB
Sample260523-dnp5faev3s
SHA256 b5a957a066a2d434bcafadbc85f5d027bd0ddfa6236755b48cfb1d7b52157201
MD5 b563e45f0d74ff3178b47b4e897976e7
SHA1 cdfc855a3c5595e40c753c537554819c402f9b3d
SHA512 fcf7264c21ef97e1b969eb3bb0e5e482e313ecbe3ef49f83d4f5c926415818cff3b509070b1500abe36cb37ab3b830e768360e2f3d397bc79f49832dc95d3a3c
SSDEEP 49152:JytwpCQK+RPytwpCQK+RPytwpCQK+RPytwpCQK+RPytwpCQK+RPytwpCQK+RPytg:l
TLSH
T177862A5D7FF21122065771B64ABFA00AF2B98413941CD954F96CC3D02FE092986FBEE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3440	4788	wscript.EXE	83
PID 3440 wrote to memory of 2220	3440	cscript.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmpwl2far7t.js
1⤵
PID:2704

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:1948

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE CULTUR~1.JS
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "CULTUR~1.JS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_512tgksb.k3l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_512tgksb.k3l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CULTUR~1.JS

Path C:\Users\Admin\AppData\Roaming\UseRead\CULTUR~1.JS
Size 42.2MB
SHA256 263dc51f3d90564aae0501cd5e5a13dccc2f8a107c7d3c728fb6e1b17f0b63e2
MD5 c5aa7bac46d79bbe1c05619bdf04c78d
SHA1 425c8aac95db9a3891946850476d812751ca9045
SHA512 e2d5c551dbea75409ba7303b2337d822208ced0db5217fedd373c9b81cebbb8d540333006988640541ddf8186ed152383d2c370e8d9c2eaf0618a8787d770ddf
SSDEEP 12288:uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuI:3
TLSH
T1A7A74CFA31AFE4B64DC278611A3A0F398761D0C1CB9E4204E6649F697CD9E1C035B8AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2220-3-0x0000023A9FFB0000-0x0000023A9FFD2000-memory.dmp

Download

memory/2220-10-0x0000023AA0050000-0x0000023AA0096000-memory.dmp

Download