98c5de4a4f36dcb691e7aec7cf3985333f349d6cd8b2bd841bc374f7b95ef9a8

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp66uz31u2.js
Size 12.9MB
Sample260602-tl6bmsbs7l
SHA256 98c5de4a4f36dcb691e7aec7cf3985333f349d6cd8b2bd841bc374f7b95ef9a8
MD5 f29fcc6d34d21b84fd6274b7454e24de
SHA1 e5865ef87089b9d98e3b65cf5a5ecea34b38ebf6
SHA512 b5d0476e70bea5eea6bfde1de6b1332151f6c0ba43ca53851d2197b689893f9da43740987fdbe15ef6c986e6329ceec3b8cdb6c2375204549baeaf6e331dff6b
SSDEEP 49152:r7BZ3zjCxbXqHlp4whVN02xhOVh0z6YzYBtpa+82y/3XI/mI/GpCa3qumhFgIcEq:L
TLSH
T17AD6B20DAEF71091A923317C8FAF640AB6748017190ADD143D8DA3945FA953867FEFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6120	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 5144	4736	wscript.EXE	83
PID 5144 wrote to memory of 6120	5144	cscript.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmp66uz31u2.js
1⤵
PID:3264

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:1044

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE INTERV~1.JS
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "INTERV~1.JS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_jxnxv0s5.aki.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jxnxv0s5.aki.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

INTERV~1.JS

Path C:\Users\Admin\AppData\Roaming\SkipLimit\INTERV~1.JS
Size 39.8MB
SHA256 146d1d8470f6d1642cb6906a2e584696cbf81b681b6422866ef33aa52b8e2f04
MD5 7c8debc2ba8f7442c9c3d06387698bfe
SHA1 17ce35b93131aa3797dbd6b91a53b946fbb5792c
SHA512 5551d93e4198fb2b30c1cb6cb40e6840dd0abd78e2b749d25b3e947aba0a2da75dbea4e05bf9799f8b697c1a7e54cad28ab8fa7859a9cbcf3f249d78bf0a1c61
SSDEEP 6144:2ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff4:n
TLSH
T1EA975CFC71E5D0B38DCF327962250DBAE62266C049815038CED26B4529A4F5C176BFAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6120-3-0x000001B1BA380000-0x000001B1BA3A2000-memory.dmp

Download

memory/6120-10-0x000001B1BA7B0000-0x000001B1BA7F6000-memory.dmp

Download