01812a0f68ccb64e1d1bf4dd7f329c2373ea7b7ba831a386d80f3e1b205fa400

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmplabbusq0.js
Size 22.5MB
Sample260602-tap6aahw3x
SHA256 01812a0f68ccb64e1d1bf4dd7f329c2373ea7b7ba831a386d80f3e1b205fa400
MD5 37faffbf9559840ab26c368380015b7e
SHA1 45751e456f6f6afb84ba4fb87566b29a3cbd451f
SHA512 2a14dd1abf5dbad4b308adb149fe89b9200a55c78ccef23b1bf384ed832e49d760c22f13b7e9c8235dce9b0b4c93c2b6308a1faa4f4544d476bf6751f32a4315
SSDEEP 49152:j7hbzjCxbhqHlp4lOrN0uRh+YfTzeYzYTvri+8mem3NQ/2bMGscL3qtAOsgecEig:S
TLSH
T1AF37A20DAEF71091A923317C8FAF640AB6748017190ADD143D8DA3945FA953867FEFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 5620	5212	wscript.EXE	84
PID 5620 wrote to memory of 1036	5620	cscript.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmplabbusq0.js
1⤵
PID:1260

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:3408

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE WASHDE~1.JS
1⤵
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "WASHDE~1.JS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_tu1nvbop.p2l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tu1nvbop.p2l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

WASHDE~1.JS

Path C:\Users\Admin\AppData\Roaming\SetOptimize\WASHDE~1.JS
Size 44.6MB
SHA256 9e64f3d5b9ab48b0b4a0b54df39212b9614e55f564af403ee3f24dc144ddd210
MD5 8e5f3dc509d437a1b00fc85ddc3291cb
SHA1 8f81a3c57c3d6c931172fa8eff7cd3a032249436
SHA512 1b539a65cea8646b8ef43ce1153cc33c98857a17c41be8982d298a02c6c6ba0e7dfd6cdf8c2627d037e3bf04d2a7fcc1bb455ef5cf9664696567b606083c23ec
SSDEEP 3072:QXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXw:3
TLSH
T140A74CFD72EEC17245C7B2F02166086C87B680D0859B5250AE75CF18BEAB52D0B679F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-9-0x000001BFBA850000-0x000001BFBA872000-memory.dmp

Download

memory/1036-10-0x000001BFBA8F0000-0x000001BFBA936000-memory.dmp

Download