4f94ce91a264d6b84085c1a37c73ab1d41a97e9de7c845cd723c7bea2e33a01f

Analysis

max time kernel
149s
max time network
120s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 16:58

Target
tmp5r8sms3z.js
Size 483KB
Sample260602-vgtbysa16w
SHA256 4f94ce91a264d6b84085c1a37c73ab1d41a97e9de7c845cd723c7bea2e33a01f
MD5 d7edd0c42fa11594f354e43f3333514a
SHA1 c790704d48a3bfbc64787f77c67cd38949006d3f
SHA512 ab54d1477099c923e0fca561ba7c502e2388a6f52d7e4fc10a4c657222866b2ec1bd9164baf0a9c27c58b1115262994a892dd3991a151219174f82306756e545
SSDEEP 6144:jQcFSMulaxl4khEfD36A7Wiagmd2iLAmWl6PSF:KYhEfD36viagmd2iLAmWl6M
TLSH
T157B4B40EABEB3326C51371799F5F9004A536840B661AEC1D7D4C93880F5863D9ABBFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2096	wscript.exe
3	2096	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmp5r8sms3z.js
1⤵
- Badlisted process makes network request
PID:2096

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact