fcda75eb7bc30baf64028d34c08a6fdce3d14487e28fa2fa34d0bd43af92b04a

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/06/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO_5778.js
Size 23.4MB
Sample260617-gsefaaa16m
SHA256 fcda75eb7bc30baf64028d34c08a6fdce3d14487e28fa2fa34d0bd43af92b04a
MD5 30b20cce036b60cdc66e039c33447b92
SHA1 301f2ba25884370ca65082228ba2adf72e702287
SHA512 0f7c89322d1b6324af555ad4eea50912724bbbcd5cbba213cf4b49ad5104267c94e4d46d3ab9e85a52d66bb01df9f61f44e018d66a8a7bd3d8f207dc810e9a1f
SSDEEP 384:KPuuuuuuuuuuuuuuuu/uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu/d:oPsNDB
TLSH
T1BF37E70232BFD70CF1F34E6D86E670946A77BBD99A75C7D801B0184E05E5C908AA2F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll%2Fjs%2006062026.txt?alt=media&token=f33cc0da-35e7-4c6f-8da1-9a5536de62f5

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1020	powershell.exe
3	1020	powershell.exe
4	1020	powershell.exe
6	1020	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1020	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1020	powershell.exe
1020	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3240	2256	wscript.exe	81
PID 2256 wrote to memory of 1408	2256	wscript.exe	83
PID 2256 wrote to memory of 1020	2256	wscript.exe	85

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO_5778.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn task name /f
  2⤵
  PID:3240
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn task name /tr "C:\Users\Admin\AppData\Local\Temp\temp name.js" /sc minute /mo minutos
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -file "C:\Users\Admin\AppData\Local\Temp\nIgFz.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_yteysghp.afm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yteysghp.afm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nIgFz.ps1

Path C:\Users\Admin\AppData\Local\Temp\nIgFz.ps1
Size 685B
SHA256 b8cacc60c82b4b7c99003b2fa2ad751164328849f9a938f6b6d05dc6e7ac09d2
MD5 b98a3b4b31eb00617dcbeba2a9c05aa8
SHA1 4450ad280d7c584743dae542d75d44c4c5bfd20e
SHA512 163ad922e20eeac0b1052ec0cd3be59ea66e582e6111fb640b6e1aa3d55728562c8d1025de52189514ae225157a63575566876c4391b1256046267d94a0e607a
TLSH
T13201231E55C7EF1D06403AFBE113D44CC3229F3BC764EF4461E1D35A9240411F6A97A5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1020-2-0x000001D5BBF30000-0x000001D5BBF40000-memory.dmp

Download

memory/1020-3-0x000001D5BBF30000-0x000001D5BBF40000-memory.dmp

Download

memory/1020-9-0x000001D5BE0E0000-0x000001D5BE102000-memory.dmp

Download

memory/1020-12-0x000001D5BBF30000-0x000001D5BBF40000-memory.dmp

Download