5db322d8b86e975dfd7e8f012b33b36d85224e67e27f569da8b04d6266988e7e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_5db322d8b86e975dfd7e8f012b33b36d85224e67e27f569da8b04d6266988e7e.js
Size 232KB
Sample260604-ry3eeahv8j
SHA256 5db322d8b86e975dfd7e8f012b33b36d85224e67e27f569da8b04d6266988e7e
MD5 32c9cb0f4b3b4d6e867edfa5f85a0575
SHA1 20e558e0fbd0762369c8f0e57a1c50b60bc3e70f
SHA512 c4926ef1d08654b069aaf38d5ff7f7f337a65242ec2c1ad57cf435edd05668fb77f7e484071f5e3788ee0f7eabac9aeea03e6da935c8b26df2e381ec655d8f41
SSDEEP 6144:XAo+6j1dOVpT6pFfRVVyaWCWs9AiP15C1NM5YSHtN6:XADpkF5dWCbuQpvtU
TLSH
T1793449B0CA2116774F87BB88BCA54661C67DC319852705B0F6C98B0D900E9ECF7BD66B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2144	PowerShell.exe	80

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2736	wscript.exe
3	1208	PowerShell.exe
4	1208	PowerShell.exe
5	1208	PowerShell.exe
6	1208	PowerShell.exe
7	1208	PowerShell.exe
8	1208	PowerShell.exe
9	1208	PowerShell.exe
10	1208	PowerShell.exe
11	1208	PowerShell.exe
13	1208	PowerShell.exe
13	1208	PowerShell.exe
11	1208	PowerShell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1208	PowerShell.exe
1208	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	PowerShell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\_5db322d8b86e975dfd7e8f012b33b36d85224e67e27f569da8b04d6266988e7e.js
1⤵
- Badlisted process makes network request
PID:2736

C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PowerShell.exe "$ensilererf=($HOME+'/app'+'data/local/stikning');$Dawenhusmo=gc $ensilererf;$Zippe=$Dawenhusmo[4361]+$Dawenhusmo[4362]+$Dawenhusmo[4363]; . ($Zippe) $Dawenhusmo"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_utehscgj.nkj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utehscgj.nkj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

stikning

Path C:\Users\Admin\appdata\local\stikning
Size 4KB
SHA256 f619747f22814b04101b968110a097cd14fbe8e7b4e2e7478ded735bbf0a8c1c
MD5 4eec7e9211d1db878ae165e74fad4372
SHA1 1ef7b1410669f88f1154f6611496a59e050c6692
SHA512 20c570651ef1430f24a1156fafcd64cdfa2e18d9de711ee3eeffebb128728602f652cdc127abaa4f25fdb35251f104fd2a464321f33575d986432041ac7174ec
SSDEEP 96:T6cBNzwDZ009h7GEDvT1uEQdXwTVPaNBvQSkycv:mcfzwDFhHReA5PAKSkye
TLSH
T1D1911A41DF26B2660E961A6F053DCB40DCDC6B693B04AF46CAB0DAF74C4C8980306CEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-6-0x00000263DBAB0000-0x00000263DBAC0000-memory.dmp

Download

memory/1208-5-0x00000263DBAB0000-0x00000263DBAC0000-memory.dmp

Download

memory/1208-13-0x00000263DBB20000-0x00000263DBB42000-memory.dmp

Download

memory/1208-14-0x00000263DBAB0000-0x00000263DBAC0000-memory.dmp

Download

memory/1208-17-0x00000263DBAB0000-0x00000263DBAC0000-memory.dmp

Download

memory/1208-16-0x00000263DBAB0000-0x00000263DBAC0000-memory.dmp

Download

memory/1208-18-0x00000263DBAB0000-0x00000263DBAC0000-memory.dmp

Download