49e8c6e6f6479a5f31a03869843d605ebf03b521b155cc7a82c87f053bc07798

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpskb4fefy.js
Size 1.7MB
Sample260602-trfm6sbv2p
SHA256 49e8c6e6f6479a5f31a03869843d605ebf03b521b155cc7a82c87f053bc07798
MD5 4ab07d4e6db00f4aa8cc4159db622b7b
SHA1 ce89eb822bff4b466a1f4ba75045b6656f64b9b3
SHA512 f8885a0c467923293cde62390171342710c926267d9e97d1394ade7ea3c798012a0882a9a61f6cd8d96ed616e00e23788bbe20f9ade2aaa417f50c6ac4ae3ce5
SSDEEP 12288:SeQlNYbhfw4Y/Az2z+FIE5AlQlDu90TsDJWx5u1xNydLpg8hC6gQl6GfwgqqQkvK:SeQcbhfj8/WHu1/wD5HroObm
TLSH
T15485B749FBD05101B867729D4E9F708EE17C501FB941AC88BD4CA8A43F9A22457EEF78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2140	2860	wscript.EXE	83
PID 2140 wrote to memory of 4416	2140	cscript.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmpskb4fefy.js
1⤵
PID:5888

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:5024

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE REHEAR~1.JS
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "REHEAR~1.JS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_b0f2ua15.wly.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0f2ua15.wly.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

REHEAR~1.JS

Path C:\Users\Admin\AppData\Roaming\ShowUse\REHEAR~1.JS
Size 38.3MB
SHA256 12ec6efd07fc8f04202a958d9126c16c65b56c41e498213c4ff701b88e90b18e
MD5 48234a1d7ae3b97a65757fdec71e6cdd
SHA1 a2d268c2f31831621be05fdccb3dd1b581e3d8f5
SHA512 2f2a8013ad4a3860a6e43be64196b59730c7ad041a72fea3dc993b8ce78d620d0c6f5cb68247e6b43db48c49475dae64a1fcd408b34be9731f657cf2957528ef
SSDEEP 6144:6hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhE:p
TLSH
T119974BF974FEC87259C3B528526A0CB99B71E5D0CAC10700DBB0DB54259AF2D8B2BDD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4416-3-0x00000185DDD20000-0x00000185DDD42000-memory.dmp

Download

memory/4416-10-0x00000185F9DF0000-0x00000185F9E36000-memory.dmp

Download