5859e084bca4e6678ed838ae3853471e2fc6913ae731aaa9c3d62f1289edfa2e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpwlywqcfn.js
Size 841KB
Sample260602-tz2wdaav5v
SHA256 5859e084bca4e6678ed838ae3853471e2fc6913ae731aaa9c3d62f1289edfa2e
MD5 aadedb9c13f2e821c50b8dc5a34b4459
SHA1 ec90663de75d9d2da78170831d03d63c99345c21
SHA512 9a7cf97de8e674ee589116a4de19ddba23de0e0410db44d44c233534ca1da6d74fad93ee0c8c56c9d416cd86c54eb2c82f473d2a5bf9156616f6855af2ae8f3f
SSDEEP 24576:lSCgo+ogQc5WfNnZmD/nqG2qcQaer+CQFWpyQTaUFNE3NEr:lSCgo+ogQc5WfNnZmD/nn2qcaoWpyQTt
TLSH
T15505F858E7DC241242737078989F94C9AC3CE41A819DAC92FD0CC194AB94AFD997FECD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4356	4016	wscript.EXE	83
PID 4356 wrote to memory of 464	4356	cscript.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmpwlywqcfn.js
1⤵
PID:1656

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:3140

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE WEBAPP~1.JS
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "WEBAPP~1.JS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_jwdyuw1l.a4k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jwdyuw1l.a4k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

WEBAPP~1.JS

Path C:\Users\Admin\AppData\Roaming\RedoExpand\WEBAPP~1.JS
Size 41.1MB
SHA256 c1bf70b5bbc6cfcfa716d8526a062cf771fdc0b410ccacf940aff3e031e532ee
MD5 a632b5425e76c57beb7fd848817cb10c
SHA1 aeffe2450d9717f065d1d75c11fa9c4ac4b3e93a
SHA512 cd00edac5ffc57cbacc6b214b433163ae081043de359258b683f458e79b40cf4401902edf54c90e29c57ce9a174bc37d45d7c7b3a524956720a0b3e699c4479e
SSDEEP 49152:3IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIj:v
TLSH
T1EC975E66B1FE43334AC77272AAAA0ED8D12AE4C446CB51198FF2C36438D9F6C5163C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-3-0x0000018D46790000-0x0000018D467B2000-memory.dmp

Download

memory/464-10-0x0000018D46C10000-0x0000018D46C56000-memory.dmp

Download