9eb4effa6b02b43d66a23bc84f3d19f140111b2e5815cd5973934c9517971693

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
encrypted (2).js
Size 9.2MB
Sample260706-wweb1sfs4p
SHA256 9eb4effa6b02b43d66a23bc84f3d19f140111b2e5815cd5973934c9517971693
MD5 a3dcfdcb0bb3ad52ae6f2ef2a3e10118
SHA1 96fb282ef063db99629330577a357a7cd7fa32bf
SHA512 eb205e2cf6b18617746a551a89f26dca17d82adec94d90dc50e35e132d45b2db8ab1055091781893488421dd3f440cdb5b37bf2c0243044c0f20e08a779eeb91
SSDEEP 24576:q9V7eBD7PsDle3qq98nbn5a++YnPfPN66VqfoCmxAg5DD3Yo+5K9iaVCf1Pkp+/g:Sgcsr9cDJ9DDzSj3DwNY63/3ifA/Ay0u
TLSH
T11AA69F40D52AD5BE4B63CB197F87BACC7D68C1DFD8C9CA45F0844B8E85B8268D0B6781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AFLlvOscPj.bat	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
1812	eepcxlhgdz.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	charmap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	charmap.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5264	charmap.exe
5264	charmap.exe
5264	charmap.exe
5264	charmap.exe
5264	charmap.exe
5264	charmap.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1812	eepcxlhgdz.exe
1812	eepcxlhgdz.exe
1812	eepcxlhgdz.exe
1812	eepcxlhgdz.exe
1812	eepcxlhgdz.exe
1812	eepcxlhgdz.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1812	eepcxlhgdz.exe
1812	eepcxlhgdz.exe
1812	eepcxlhgdz.exe
1812	eepcxlhgdz.exe
1812	eepcxlhgdz.exe
1812	eepcxlhgdz.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1812	2368	wscript.exe	87
PID 1812 wrote to memory of 5264	1812	eepcxlhgdz.exe	88
PID 1812 wrote to memory of 5264	1812	eepcxlhgdz.exe	88

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\encrypted (2).js"
1⤵
- Drops startup file
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\Nx2981Okkr2\eepcxlhgdz.exe
  "C:\Users\Admin\AppData\Local\Temp\Nx2981Okkr2\eepcxlhgdz.exe" "C:\Users\Admin\AppData\Local\Temp\Nx2981Okkr2\wvwxrhlfxquucjpewcitbkp.cfg"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\System32\charmap.exe
    C:\Windows\System32\charmap.exe
    3⤵
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eepcxlhgdz.exe

Path C:\Users\Admin\AppData\Local\Temp\Nx2981Okkr2\eepcxlhgdz.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wvwxrhlfxquucjpewcitbkp.cfg

Path C:\Users\Admin\AppData\Local\Temp\Nx2981Okkr2\wvwxrhlfxquucjpewcitbkp.cfg
Size 15KB
SHA256 7916585b93d059fcaf662df143b97527cd50a7343025807500d19c89abbfe394
MD5 ad13e476653fa765ae5e8b0ee8114b8e
SHA1 f10873c7deeee7eed152453662e9e4eaed3e3c18
SHA512 5dc71355e8116a79f8475cf21690d9719729e532f493511451bc324cf322a50881134df2d94a436a799dc63820b619b768905183319dab8bc3fb2b1be27a623d
SSDEEP 192:YcKPQ7vUKRICA0j0jg2pmIphmYDRqOez48YCGxpc8djHvCvLMYrOzBU5O7y:YcKPaUH0jUpxph9R8AckDCDN6zBU5O7y
TLSH
T10A723B9D695FE814638C1048CD3B8D66FE5C0CBDA42D3740AA49EA4E4438B3E43E77B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zorsxklxfehdoals

Path C:\Users\Admin\AppData\Local\Temp\Nx2981Okkr2\zorsxklxfehdoals
Size 1.0MB
SHA256 ddfeb503530b435f6f92a0ef650fe1531e46cb7b036263fe5f5734731d3e2436
MD5 603b70781f0df703f06069d633d9b7b7
SHA1 0fde353d7dd10fab5fbf44dc6bd17b610f3a74f8
SHA512 9375e7edd986773c366a053cff6d8a1aa81a90e18550a9fbbec6babace300c01e55eb433632c9a954a15f415f5f9d40225a16f847b8a2774a66cc616c85785b0
SSDEEP 24576:dWdm9nBQqTtW32FI1+k/kOJCa7XNxoBuuyd8gSTBDHa:Us6q5W3cIYksyL7XNxo1cqTFHa
TLSH
T1B335334976C80E485C6FD1F0F5FF4C3A963741AACB5D0FA792C55AEB889805D3B22D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5264-12-0x000002C578E90000-0x000002C578F94000-memory.dmp

Download

memory/5264-13-0x000002C578E90000-0x000002C578F94000-memory.dmp

Download

memory/5264-14-0x0000000000400000-0x00000000004F9000-memory.dmp

Download

memory/5264-16-0x0000000140000000-0x0000000140100000-memory.dmp

Download

memory/5264-24-0x000002C578E90000-0x000002C578F94000-memory.dmp

Download