ed963adb6a721961f2c623f8b0616b4250e8bcd496217b2f6827066d5351e150

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 03:48

Target
tmp8hmkvtxr.js
Size 296KB
Sample260523-ec8cbaez41
SHA256 ed963adb6a721961f2c623f8b0616b4250e8bcd496217b2f6827066d5351e150
MD5 034958b585224eda92ebdaf10b4e8675
SHA1 240176fbf7e477056a717c2f9ac6b2eec370ee4b
SHA512 30cae9496e1bcf4856cf570517106c608a7f45ecbacba982ab9323691f7b17664feb55fa061026b982b6e7f9c136bda331022dbaaef462fa64cc25da64aa0075
SSDEEP 6144:9aavxfbLY8Cv4okFFmwPFbP6s3JXq/HD0KUWrE4/Xp89JwvY1Z5xOsi25pHeJq51:6OPFbP/670KUWrE4/589zCbqHeYb7PV3
TLSH
T1BB54B3D9734F116F4BA233AAE43B5149FF7DD1B0520550ACB58D997C24A081883BAFBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3252	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmp8hmkvtxr.js
1⤵
- Badlisted process makes network request
PID:3252

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact