Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
03/07/2026, 12:17
General
- Target 19-KJY-189047817387 2026072 384091782.js
- Size 94KB
- Sample260703-pgdzdadz2n
- SHA256 6955ccfb52cce9fc34bf0a29f5dd941345455734b0df3b7944dada26af45870c
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\19-KJY-189047817387 2026072 384091782.js"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "$Jers229=gc ($HOME+'/app'+'data/local/Folkeak');$Flubbedbob=$Jers229[2914]+$Jers229[2915]+$Jers229[2916]; . ($Flubbedbob) $Jers229"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Jers229=gc ($HOME+'/app'+'data/local/Folkeak');$Flubbedbob=$Jers229[2914]+$Jers229[2915]+$Jers229[2916]; . ($Flubbedbob) $Jers229"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Termino.Klo
Folkeak
memory/1504-32-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-33-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-42-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-40-0x00000249008F0000-0x00000249013CF000-memory.dmp
memory/1504-38-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-37-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-36-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-35-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-34-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-31-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-30-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-29-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-23-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-22-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/1504-28-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/2428-41-0x000001911E170000-0x000001911E25B000-memory.dmp
memory/3836-7-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-12-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-17-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-16-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-15-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-1-0x00007FFC5C54F000-0x00007FFC5C550000-memory.dmp
memory/3836-18-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-8-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-5-0x0000025928B70000-0x0000025928B92000-memory.dmp
memory/3836-24-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-11-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-10-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-2-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-6-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-14-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp
memory/3836-9-0x00007FFC5C3C0000-0x00007FFC5CD64000-memory.dmp