c90c42b27f5bd76c587d7c17ed5d16df7a58120b21331fdc8d2306ad561898f2

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 15:23

Target
WindowsUpdate_evClient.js
Size 106KB
Sample260625-ssh91scy5v
SHA256 c90c42b27f5bd76c587d7c17ed5d16df7a58120b21331fdc8d2306ad561898f2
MD5 ee4d386131d7e9bcaaadc75e52896b5b
SHA1 67c20b48a09fd4de2a126cc0a895e49b118d953f
SHA512 668f75df37801e17da249896e60afbe70f1d6c71d7732d2e4b687eb193d879f6ed29a0a19caae60cd907ae4d12c741b909285e00bb98edc8f51ca15fdb2525ee
SSDEEP 3072:AvfcswIUMdF9n0895SAJFk6mZ8Tr3MBnRldAXTLeRH5lm3:ARVUMdFdCAVNn+n3SXvoH5M
TLSH
T142B36DCAC92A45925C1077F17D2E6FCE6A2C82EDC4CC539DF549E2B03E4C27D259EA08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	1396	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\WindowsUpdate_evClient.js
1⤵
- Badlisted process makes network request
PID:1396

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact