51379f4acb028f106dff9e97d2fffe91ef2ed5eb377dfdafbe87b14d4f64044e

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mohafile.js
Size 1.2MB
Sample260716-htm99aax3x
SHA256 51379f4acb028f106dff9e97d2fffe91ef2ed5eb377dfdafbe87b14d4f64044e
MD5 37cd3b88d603cf06ac5d3f0bb60bc2aa
SHA1 85a9f1bcbfdc1a05c49550b447675044c5bbfc0e
SHA512 174cbb2846c7cdae407784313bc4caf3b15a78bcd0671b9b10c18f5595fe3f3d8cb4598d2cea4b183d9237579e8a49795ddf82704edb986c4ea5248ac4a62979
SSDEEP 24576:+IOjh6Kz6O3FIMi6IPqbUTX1W/tjwvClgRBn9CF9C7DhBy60K1:+x9xi3qog/oC+tCWm6f
TLSH
T1E9459E6A0B6C401ADEC9A12B264D65C3F8B1AF01F170B450E7B849B5F6CDF8930796E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4228	powershell.exe	90

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5060 set thread context of 1052	5060	powershell.exe	98

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5060	powershell.exe
5060	powershell.exe
1052	powershell.exe
1052	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 60	5060	powershell.exe	96
PID 60 wrote to memory of 3340	60	csc.exe	97
PID 5060 wrote to memory of 1052	5060	powershell.exe	98
PID 5060 wrote to memory of 1052	5060	powershell.exe	98
PID 5060 wrote to memory of 1052	5060	powershell.exe	98

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\mohafile.js
1⤵
PID:1676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w 1 -nop -ex unrestricted -f "C:\Users\Admin\AppData\Local\Temp\net_10838_7c2e.ps1"
1⤵
- Process spawned unexpected child process
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tiy25cex\tiy25cex.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A0B.tmp" "c:\Users\Admin\AppData\Local\Temp\tiy25cex\CSC4D96F1FEC744B9FB457304A4AAB362.TMP"
    3⤵
    PID:3340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8A0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8A0B.tmp
Size 1KB
SHA256 0e4c3d44660eaab681ed601b92468d3a109e20524a8ae5c394d92f8d6eb1cfe7
MD5 01b11c52ef7e84d3d4be1352c928e3fe
SHA1 bd397021b85ec8fcec92b16842f3b2cf8438db8b
SHA512 bd4974513fbc315d0fa1078c1c8c4ac495a6d09d78bd5221adbb474869a35d43f9c218d5e7df3a4e24c15f35fd6dce3b81c8961796a93ab4b0f8cb1883fdfb0c
TLSH
T15621590553EC471AF0735B316DF6072BA624FDA9EFA2975B8580522C2C51544EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fy13cqwc.c1d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fy13cqwc.c1d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

net_10838_7c2e.ps1

Path C:\Users\Admin\AppData\Local\Temp\net_10838_7c2e.ps1
Size 4KB
SHA256 26d9152b09accfdc9678cb5defa45d9bc6afc6bc8f9671e9d53fbe61d30bfe66
MD5 ca21864c5971c43e92cff5e86e1fa00c
SHA1 6100f08f53dd5ace537d23f728b65c03dca6b56b
SHA512 4e5da0b6a1b3c49467b260a5f8146e02c74afbda822bb74fec41a00d3a32415240bcf7da0d9f3f17a9760670566cef677f35d7e7ce3bf3f1596c3bc6c6d27ccb
SSDEEP 96:t3XKvn0un2ron8iQPL53+M83wcL5DYmHkLcvcSdvBwDF8GgoGAIWoulDV8+Qo:NXsn/nPn8iQD0M0wIFZHkLcvcSyUfYbv
TLSH
T191917349BBEE55F901C3287589A24242BD98C82F011B0D08F66CD7E5FF57479C2FA19A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_61763_7c2e

Path C:\Users\Admin\AppData\Local\Temp\net_61763_7c2e
Size 93KB
SHA256 9b261ff065b286f16281aa6dc3ec25d54fbdbda103d9c9bd07d1bb9a527e07ec
MD5 236988f3c7173067fcb2da60301e75c1
SHA1 41ce4476216fbc8d24c4556e11e0c513f988c472
SHA512 f056bce940d99140407b2ec8da9e1b7f996f2c7b1ed434e1944acb83f6cebdad02bc47a107fa72223a7ddf26e3be64c7e89c96a86f6a7296f2cc95b329f94b58
SSDEEP 1536:3orRmG6jHgy9zdDa0xyNhGjmZ0xOJMyEWZArZ5oNYG1Vuq8aKRQ352rlawP+x+Mu:3csjh9xDcoI0ly3UZo1kOgQ352r8w2xq
TLSH
T1D893020BCF618FAC9DB81D9838FC7BDA15519C840D24E9B280B934532BA336595EB79C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run_24661_7c2e

Path C:\Users\Admin\AppData\Local\Temp\run_24661_7c2e
Size 491KB
SHA256 482bb8d351879a6affa71383f6090ce42b56335752732a4086d6127c3b57e381
MD5 1592aea75a182d456891d8f3c816ac7a
SHA1 e0547d9f4ef8b5a0e2546e47ad035ddae22cf458
SHA512 48f2d61a65ac72d79ee9261568d089deb11fb3f8abd348ec12d7b2d536c043b67347daaf458d11c9acc2a8f9f9af9e946a97350ffc3b3824c7f1fd56237e9cc9
SSDEEP 12288:eAouAcCloB944lvB/5UXdDx6fClMqPiQNNrYkcE67c8pP:e3ov46B/Q6fCmOrNFY66gG
TLSH
T116B4124D4D35CA78DA981A88247E1F882FB40EC0947CBB8BF87670B75A8777720761B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tiy25cex.dll

Path C:\Users\Admin\AppData\Local\Temp\tiy25cex\tiy25cex.dll
Size 3KB
SHA256 bc68d1a0a906f8160a6422215035384ed78cc130c84604f3175568c503ff5c47
MD5 10842e3c7ef8ebd60683275b9ea1e1d0
SHA1 e8e05a4f1354ecea2fbce8eaf1f5ff5b3748941e
SHA512 9a1a8eae4020eeae38c52e7844a96735a722b197ccc4b1940543a95e67ef902d29d691a1ca0e3e3f55417c34d3b40934792b64136037183ac4f98279b608a2e8
TLSH
T14251DD1B5BE8862BF07307305DF3431677B4F8509BB3A71E1D905218AC216985E31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4D96F1FEC744B9FB457304A4AAB362.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\tiy25cex\CSC4D96F1FEC744B9FB457304A4AAB362.TMP
Size 652B
SHA256 d0ac007b6e0ec0e83e9c6ddbfc8f98570110caaa22cb6b9c7d26b539881f2020
MD5 cc90467c898b0c3aa101ef0d3a54fe2f
SHA1 5f484b88fb2bfbfa310ed40f50c75972f1cc9cd1
SHA512 897a26dbca8516b0b2307293604835c90f475d5f3190c8b4a0108c3fc7b4ca7f36a4d14cc5d98f42ef0a24a9a816c8fdbd3be1b7ed3642f3d41792bcd1411022
TLSH
T160F0540A63FC020EF0F38B30BDF543A3A568BCA5DE3293ED1480131D18645149961F72
MD5 SHA1 SHA512 TLSH

Submit Download

tiy25cex.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tiy25cex\tiy25cex.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

tiy25cex.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\tiy25cex\tiy25cex.cmdline
Size 369B
SHA256 009c78cd85c6fafd7a1f4af61e38aeb21190b80bf60ee462eb863b19508e9bb4
MD5 caeb8810731a107e371502272cdc43f1
SHA1 94f82a3eb5836f1fb1b6b871fa276ff4a6e50660
SHA512 a037280d2706f5b30ece873c3bda10c301dcafa0b92409ad20035160c37e320679bf1341650c9bab18497a411996644bffb6ef78d27a1dfab241ea58a310d9b3
TLSH
T15BE0682A628AC27D92DD200721F9C4AC87F216432E403F84D040441DD0270C0A7E1B4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5060-4-0x0000028BBB860000-0x0000028BBB870000-memory.dmp

Download

memory/5060-5-0x0000028BBB810000-0x0000028BBB832000-memory.dmp

Download

memory/5060-15-0x0000028BBB860000-0x0000028BBB870000-memory.dmp

Download

memory/5060-17-0x0000028BA3570000-0x0000028BA3584000-memory.dmp

Download

memory/5060-3-0x0000028BBB860000-0x0000028BBB870000-memory.dmp

Download

memory/5060-30-0x0000028BBCBA0000-0x0000028BBCBA8000-memory.dmp

Download

memory/5060-31-0x0000028BBCBB0000-0x0000028BBCBB8000-memory.dmp

Download