Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 06:23
General
- Target LX_TKMRA5n0oAe.js
- Size 3.6MB
- Sample260604-g5vb9sax5x
- SHA256 135a58e767fa96d49e1f74068b3cb54486321595ab88a0819f5e4aa5a6e317a2
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\LX_TKMRA5n0oAe.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\Users\Admin\AppData\Local\Microsoft\Windows\00000000-d7809b15-2dea0da8a083\Interface_LIB.ps1'"2⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
- Loads dropped DLL
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Interface_LIB.ps1
payload_stub.dll
__PSScriptPolicyTest_x5pvmho1.q3j.ps1
a4e2e302cc4440ab8cbca29bc9c17722.db
memory/3756-14-0x000001B0B5330000-0x000001B0B5340000-memory.dmp
memory/3756-10-0x000001B0B5330000-0x000001B0B5340000-memory.dmp
memory/3756-12-0x000001B0B7470000-0x000001B0B7488000-memory.dmp
memory/3756-13-0x000001B0B7490000-0x000001B0B7498000-memory.dmp
memory/3756-2-0x000001B0B5330000-0x000001B0B5340000-memory.dmp
memory/3756-9-0x000001B0B7420000-0x000001B0B7442000-memory.dmp
memory/3756-1-0x000001B0B5330000-0x000001B0B5340000-memory.dmp
memory/4220-15-0x000001613DB90000-0x000001613DB91000-memory.dmp
memory/4220-18-0x0000000000400000-0x000000000048E000-memory.dmp
memory/4220-22-0x000001615A990000-0x000001615A9E0000-memory.dmp
memory/4220-23-0x000001615ABB0000-0x000001615AD72000-memory.dmp
memory/4220-24-0x000001615B2B0000-0x000001615B7D8000-memory.dmp