Analysis
- max time kernel
149s - max time network
150s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
09/06/2026, 14:54
Static task
static1
Behavioral task
behavioral1
Sample
tmpw6uaeykv.js
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpw6uaeykv.js
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpw6uaeykv.js
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target tmpw6uaeykv.js
- Size 841KB
- Sample260609-sacphscz5j
- SHA256 562a0027ecbd748ca23e055c3cfd7cb554657dc26127535bc1418afc6c5fd1fa
- MD5 b5162e52fada844a5ca834ecff8c08bf
- SHA1 5b5c5f22ff996cc320e17e40bf2408568f89d393
- SHA512 ba798a7f145f0a2cc6240729d6096bd688a8139ba435d64034d98ea72f4852e11299fb11520054254ad3d9de14ce3ad1480c28573bfd5227f4162d9e0366bd5f
- SSDEEP 24576:OFCgo+ogQc5WfNnZmD/n3gUC9NYeKwUlOWpyQTaEFNE3NEr:OFCgo+ogQc5WfNnZmD/nwUC9jrWpyQTZ
- TLSH T16C05E858E7DC240242737078989F94C9AC3CD41A819EAC92FD0CC194AA94BFD997FEDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 30 1528 poWerSHEll.EXe 39 1528 poWerSHEll.EXe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation wscript.EXE - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ poWerSHEll.EXe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1528 poWerSHEll.EXe 1528 poWerSHEll.EXe 1528 poWerSHEll.EXe 1528 poWerSHEll.EXe 1528 poWerSHEll.EXe 1528 poWerSHEll.EXe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1528 poWerSHEll.EXe Token: SeIncreaseQuotaPrivilege 1528 poWerSHEll.EXe Token: SeSecurityPrivilege 1528 poWerSHEll.EXe Token: SeTakeOwnershipPrivilege 1528 poWerSHEll.EXe Token: SeLoadDriverPrivilege 1528 poWerSHEll.EXe Token: SeSystemProfilePrivilege 1528 poWerSHEll.EXe Token: SeSystemtimePrivilege 1528 poWerSHEll.EXe Token: SeProfSingleProcessPrivilege 1528 poWerSHEll.EXe Token: SeIncBasePriorityPrivilege 1528 poWerSHEll.EXe Token: SeCreatePagefilePrivilege 1528 poWerSHEll.EXe Token: SeBackupPrivilege 1528 poWerSHEll.EXe Token: SeRestorePrivilege 1528 poWerSHEll.EXe Token: SeShutdownPrivilege 1528 poWerSHEll.EXe Token: SeDebugPrivilege 1528 poWerSHEll.EXe Token: SeSystemEnvironmentPrivilege 1528 poWerSHEll.EXe Token: SeRemoteShutdownPrivilege 1528 poWerSHEll.EXe Token: SeUndockPrivilege 1528 poWerSHEll.EXe Token: SeManageVolumePrivilege 1528 poWerSHEll.EXe Token: 33 1528 poWerSHEll.EXe Token: 34 1528 poWerSHEll.EXe Token: 35 1528 poWerSHEll.EXe Token: 36 1528 poWerSHEll.EXe Token: SeIncreaseQuotaPrivilege 1528 poWerSHEll.EXe Token: SeSecurityPrivilege 1528 poWerSHEll.EXe Token: SeTakeOwnershipPrivilege 1528 poWerSHEll.EXe Token: SeLoadDriverPrivilege 1528 poWerSHEll.EXe Token: SeSystemProfilePrivilege 1528 poWerSHEll.EXe Token: SeSystemtimePrivilege 1528 poWerSHEll.EXe Token: SeProfSingleProcessPrivilege 1528 poWerSHEll.EXe Token: SeIncBasePriorityPrivilege 1528 poWerSHEll.EXe Token: SeCreatePagefilePrivilege 1528 poWerSHEll.EXe Token: SeBackupPrivilege 1528 poWerSHEll.EXe Token: SeRestorePrivilege 1528 poWerSHEll.EXe Token: SeShutdownPrivilege 1528 poWerSHEll.EXe Token: SeDebugPrivilege 1528 poWerSHEll.EXe Token: SeSystemEnvironmentPrivilege 1528 poWerSHEll.EXe Token: SeRemoteShutdownPrivilege 1528 poWerSHEll.EXe Token: SeUndockPrivilege 1528 poWerSHEll.EXe Token: SeManageVolumePrivilege 1528 poWerSHEll.EXe Token: 33 1528 poWerSHEll.EXe Token: 34 1528 poWerSHEll.EXe Token: 35 1528 poWerSHEll.EXe Token: 36 1528 poWerSHEll.EXe Token: SeIncreaseQuotaPrivilege 1528 poWerSHEll.EXe Token: SeSecurityPrivilege 1528 poWerSHEll.EXe Token: SeTakeOwnershipPrivilege 1528 poWerSHEll.EXe Token: SeLoadDriverPrivilege 1528 poWerSHEll.EXe Token: SeSystemProfilePrivilege 1528 poWerSHEll.EXe Token: SeSystemtimePrivilege 1528 poWerSHEll.EXe Token: SeProfSingleProcessPrivilege 1528 poWerSHEll.EXe Token: SeIncBasePriorityPrivilege 1528 poWerSHEll.EXe Token: SeCreatePagefilePrivilege 1528 poWerSHEll.EXe Token: SeBackupPrivilege 1528 poWerSHEll.EXe Token: SeRestorePrivilege 1528 poWerSHEll.EXe Token: SeShutdownPrivilege 1528 poWerSHEll.EXe Token: SeDebugPrivilege 1528 poWerSHEll.EXe Token: SeSystemEnvironmentPrivilege 1528 poWerSHEll.EXe Token: SeRemoteShutdownPrivilege 1528 poWerSHEll.EXe Token: SeUndockPrivilege 1528 poWerSHEll.EXe Token: SeManageVolumePrivilege 1528 poWerSHEll.EXe Token: 33 1528 poWerSHEll.EXe Token: 34 1528 poWerSHEll.EXe Token: 35 1528 poWerSHEll.EXe Token: 36 1528 poWerSHEll.EXe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3844 wrote to memory of 5052 3844 wscript.EXE 89 PID 5052 wrote to memory of 1528 5052 cscript.exe 96 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\tmpw6uaeykv.js1⤵PID:3652
-
C:\Windows\system32\wscript.exewscript1⤵PID:4036
-
C:\Windows\system32\wscript.EXE"C:\Windows\system32\wscript.EXE" HPBUSI~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "HPBUSI~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\System32\WindowsPowerShell\v1.0\poWerSHEll.EXepoWerSHEll.EXe3⤵
- Badlisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oyeejsvy.snb.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\HPBUSI~1.JS
- Size 40.4MB
- SHA256 ecaa2e399d709ad233ee641d77253f89e429dc51c65cd48fe24a81f11b0364bd
- MD5 63ee7320c05ca4fb226d6c1ebb62aeb3
- SHA1 8428f1b44f574f1ad7ca2c5f2f3dde1196a97933
- SHA512 c9e6441c8c404f5c74660b7cfce669420944faf61a5aebae67a77b8fb6f2de25a0d8589aa64c947c5ddb0e9b20e2c459a3106d05a5c6fdbf5560d2786303257a
- SSDEEP 6144:6llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllY:X
- TLSH T19D976D7CB198A9F31BCBB4284F3A893B9E5144C8C68E4464CA70DB6854DAD1D4397CFE
- MD5 SHA1 SHA512 SSDEEP TLSH