27bbe5eed9b7f5226bc5cc292658c11da8ce5fbbb82f17da1b17fa22199ae1fc

Analysis

max time kernel
70s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MTCN_693449106392956738282808728466055197.js
Size 692KB
Sample260624-phlevacs4m
SHA256 27bbe5eed9b7f5226bc5cc292658c11da8ce5fbbb82f17da1b17fa22199ae1fc
MD5 44d5c329667982c73915522544f30be0
SHA1 b4f393e8f3e1438d23d0b8296b2a145325708489
SHA512 c7924889540a9db7e39c24bdb9524da9951334e450fe279eb42d27601458c70a0e7cc98b1a6e5e1a1032098a9bb15ee896d857fdbaf292cbc2d7ed9b58326a18
SSDEEP 3072:cYoc+F/smPBeGlG+tR15jSrHNTLvoHrnQdcPJDWuE9aSsp2NsZQT7vnBaWRSFXCY:MWTLvwjhV7geyu
TLSH
T1BFE4E8C44B8ED4035ACC2D43BF9DBBE7512992A3969872839A5DFB8805B74D781ECCC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4224	wscript.exe
4	4224	wscript.exe
5	4224	wscript.exe
6	4224	wscript.exe
7	4224	wscript.exe
8	4224	wscript.exe
9	4224	wscript.exe
10	4224	wscript.exe
11	4224	wscript.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{EA878E9F-E187-448E-B8C5-58EC6983B3AB}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3728	explorer.exe
Token: SeCreatePagefilePrivilege	3728	explorer.exe
Token: SeShutdownPrivilege	3728	explorer.exe
Token: SeCreatePagefilePrivilege	3728	explorer.exe
Token: SeShutdownPrivilege	3728	explorer.exe
Token: SeCreatePagefilePrivilege	3728	explorer.exe
Token: SeShutdownPrivilege	3728	explorer.exe
Token: SeCreatePagefilePrivilege	3728	explorer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3476	sihost.exe
3728	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 3728	3476	sihost.exe	94

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MTCN_693449106392956738282808728466055197.js
1⤵
- Badlisted process makes network request
PID:4224

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3728

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4704

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4704-20-0x00000200801E0000-0x00000200802E0000-memory.dmp

Download

memory/4704-27-0x0000020082DE0000-0x0000020082EE0000-memory.dmp

Download

memory/4704-43-0x00000200940E0000-0x0000020094100000-memory.dmp

Download

memory/4704-34-0x0000020082B70000-0x0000020082B90000-memory.dmp

Download

memory/4704-26-0x0000020082930000-0x0000020082950000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads