88d2a0e496d4d3132f4200d37337428247f761733a03821576574500789f3532

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 13:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
T.HALKBANKASI.js
Size 31KB
Sample260608-p9erdaev7z
SHA256 88d2a0e496d4d3132f4200d37337428247f761733a03821576574500789f3532
MD5 39b4a249d99adc9ec081ba7cf0669b43
SHA1 439b86f31f8816fdd86ed6f0ee19a37d27914d8a
SHA512 5cf0fde6e6bed651e7830e13d88e5767462e9f071a37f9b3997e7afcae7fc1171db831f9c1fe1671ce6330a23415270fe1c31a471aae7cc43bb7813046499cb9
SSDEEP 384:yhs6GE1/T3YMOp6Jx5XwG++Hqa4B64L0sk4mxsQROlDA4p9l4x4RgbwRhYH5vwBO:n8MZ6wbSqa4CskaDpzibwR259h4eUPSN
TLSH
T14AE229A1FB16017B4F5267CCBF89D12085BE935A4826B5B1F9CFC30E9A09C8CD7B4859
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4168	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4492	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4168	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundTaskHost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4168	powershell.exe
4168	powershell.exe
4492	powershell.exe
4492	powershell.exe
4492	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4492	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	4492	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3260	3560	wscript.exe	80
PID 4980 wrote to memory of 3200	4980	explorer.exe	82
PID 3200 wrote to memory of 4168	3200	cmd.exe	84
PID 4492 wrote to memory of 5536	4492	powershell.exe	89
PID 4492 wrote to memory of 980	4492	powershell.exe	90
PID 4492 wrote to memory of 980	4492	powershell.exe	90

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\T.HALKBANKASI.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\Maoistern22.lnk"
  2⤵
  PID:3260

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c START "Barbaris" /min powershell.exe -COMMAND "$extra=gc ($HOME+'/app'+'data/local/Joco');$Pilta=$extra[4355]+$extra[4356]+$extra[4357]; . ($Pilta) $extra" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -COMMAND "$extra=gc ($HOME+'/app'+'data/local/Joco');$Pilta=$extra[4355]+$extra[4356]+$extra[4357]; . ($Pilta) $extra"
    3⤵
    - Badlisted process makes network request
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4168

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$extra=gc ($HOME+'/app'+'data/local/Joco');$Pilta=$extra[4355]+$extra[4356]+$extra[4357]; . ($Pilta) $extra"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\SysWOW64\backgroundTaskHost.exe"
  2⤵
  PID:5536
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\SysWOW64\backgroundTaskHost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0922a7d0b56e0c901a13d1617f99d752aa2abf5201089749005ecf7b413b4a91
MD5 e42748b8c5a22dfa1e01198891ce72ac
SHA1 c201063995355d307cc3916221eb9a0f10b5284f
SHA512 8be07fa5d55634cc5f7106eed3f78e5d0a21baf3bbedcfd79b55401d202a7e8d297f889d688ba0cf77a917632935bbccb43bb8c3622ff90dc4ab537ff840ad66
TLSH
T1A521A833B3ACC135C8D9017A208CAD01B2B5C3C7449ECECB7B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

Maoistern22.lnk

Path C:\Users\Admin\AppData\Local\Temp\Maoistern22.lnk
Size 1002B
SHA256 1912c6e4715662cb82e434e53227f7b7d1efb1b6265b0439fbbfbc2abd734ad8
MD5 53afc478a8cd8b826023ec93d4f046fa
SHA1 7be172b19cd840155a2683d5692f74201b9e0667
SHA512 9949028c9c7df94184c6b87b5a29a8e683702913eb496cd348b40ca1f80a655adaf4a57872c3fdff8e35e8cd73226d7a43dd3430aedc4e60104969d95a42a5fd
TLSH
T1B01168080EDA0316DAB3EE36A4BE9710D8367846FA639F0D40884B8C59B66116825F3E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wnwaggsu.stw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wnwaggsu.stw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Superquali.Bri

Path C:\Users\Admin\AppData\Roaming\Superquali.Bri
Size 226KB
SHA256 fb9a9faf3d3f0eaf9940ab27836cdc22a7517f000c7eebf8b299cedc7c1b0f02
MD5 8dac2d43950d5f3b8854fb9c21c0aa55
SHA1 1e5520ba3bb1c03f350d9b5ce49d073a86cdef95
SHA512 07f140aabfb05c26cefc21f9dd6a67c4f88f8b43f5600a3e199e21c3c2ff8b1ebd3e28bdba9a5aba5bbbef84166059e1353759c278c7460ca6c1bb25426ae72d
SSDEEP 6144:xHhTtZFcm4GBsY/N7wE81Vb6VIT9ctzKtmSN2k:qhE8Tb5ipk
TLSH
T15F3402CA9DA0F208F1DAF55509E7AF2F93419D89D0AC94C3575ADC9EDC02F92307B1A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Joco

Path C:\Users\Admin\appdata\local\Joco
Size 4KB
SHA256 52aaec44460dcdb0479ad8d51e1eba8af745e2110a02b0f09b089d6782a5e944
MD5 9248b4e45f46795e470b08ea0e559240
SHA1 3d714d26ec6616fc43fae0a71c80becfd7c0cb79
SHA512 ab8626adeba09c52e060772092fb3c349c9e54616e6acf0c49ce16d322411a599dfd38969229b92ce43ba5d95f61c3b3be438ae719ed7aa76f9fe118ad445b13
SSDEEP 96:wJH+2yg5q6pd0MasIvd3FgFn5M5kqXhgpovaFAgpAVV9uh:w0wzas6l+NO7K/Ag6q
TLSH
T1EC91FAF47F02AD99813767E76C7DB704582E8602703995F7EAD6C7CB60105A2ECB8C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4168-11-0x000001B9FF260000-0x000001B9FF282000-memory.dmp

Download

memory/4492-18-0x0000000005A40000-0x000000000606A000-memory.dmp

Download

memory/4492-32-0x0000000007800000-0x0000000007896000-memory.dmp

Download

memory/4492-21-0x00000000060E0000-0x0000000006146000-memory.dmp

Download

memory/4492-28-0x00000000062D0000-0x0000000006627000-memory.dmp

Download

memory/4492-19-0x0000000005960000-0x0000000005982000-memory.dmp

Download

memory/4492-30-0x00000000067E0000-0x00000000067FE000-memory.dmp

Download

memory/4492-31-0x0000000006820000-0x000000000686C000-memory.dmp

Download

memory/4492-20-0x0000000006070000-0x00000000060D6000-memory.dmp

Download

memory/4492-33-0x0000000006D30000-0x0000000006D4A000-memory.dmp

Download

memory/4492-34-0x0000000006D90000-0x0000000006DB2000-memory.dmp

Download

memory/4492-35-0x0000000008080000-0x0000000008626000-memory.dmp

Download

memory/4492-36-0x0000000008CB0000-0x000000000932A000-memory.dmp

Download

memory/4492-17-0x0000000003080000-0x00000000030B6000-memory.dmp

Download

memory/4492-38-0x0000000009330000-0x000000000EE78000-memory.dmp

Download