Analysis
- max time kernel
148s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
23/06/2026, 08:21
General
- Target _222d90550cece5cac50f93f57c476e9f8d4ce2e011544cc3c274173787096f90.js
- Size 3.9MB
- Sample260623-j828dsbs7j
- SHA256 222d90550cece5cac50f93f57c476e9f8d4ce2e011544cc3c274173787096f90
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\_222d90550cece5cac50f93f57c476e9f8d4ce2e011544cc3c274173787096f90.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 15 /tn _222d90550cece5cac50f93f57c476e9f8d4ce2e011544cc3c274173787096f90 /tr C:\Users\Admin\Documents\_222d90550cece5cac50f93f57c476e9f8d4ce2e011544cc3c274173787096f90.url2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 15 /tn _222d90550cece5cac50f93f57c476e9f8d4ce2e011544cc3c274173787096f90 /tr C:\Users\Admin\Documents\_222d90550cece5cac50f93f57c476e9f8d4ce2e011544cc3c274173787096f90.url3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\Documents\SQVXDWARSKFHIYIX.PIF"C:\Users\Admin\Documents\SQVXDWARSKFHIYIX.PIF" C:\Users\Admin\Documents\SQVXDWARSKFHIYIX.ttf2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_222d90550cece5cac50f93f57c476e9f8d4ce2e011544cc3c274173787096f90.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\SQVXDWARSKFHIYIX.PIF"C:\Users\Admin\Documents\SQVXDWARSKFHIYIX.PIF" C:\Users\Admin\Documents\SQVXDWARSKFHIYIX.ttf2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SQVXDWARSKFHIYIX.PIF
SQVXDWARSKFHIYIX.ttf
memory/3448-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-67-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3448-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-60-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3448-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-37-0x00000000024F0000-0x0000000002536000-memory.dmp
memory/3448-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3448-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-61-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5680-18-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5680-69-0x0000000000400000-0x0000000000482000-memory.dmp