51379f4acb028f106dff9e97d2fffe91ef2ed5eb377dfdafbe87b14d4f64044e

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mohafile.js
Size 1.2MB
Sample260716-htm99aax3x
SHA256 51379f4acb028f106dff9e97d2fffe91ef2ed5eb377dfdafbe87b14d4f64044e
MD5 37cd3b88d603cf06ac5d3f0bb60bc2aa
SHA1 85a9f1bcbfdc1a05c49550b447675044c5bbfc0e
SHA512 174cbb2846c7cdae407784313bc4caf3b15a78bcd0671b9b10c18f5595fe3f3d8cb4598d2cea4b183d9237579e8a49795ddf82704edb986c4ea5248ac4a62979
SSDEEP 24576:+IOjh6Kz6O3FIMi6IPqbUTX1W/tjwvClgRBn9CF9C7DhBy60K1:+x9xi3qog/oC+tCWm6f
TLSH
T1E9459E6A0B6C401ADEC9A12B264D65C3F8B1AF01F170B450E7B849B5F6CDF8930796E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	5920	powershell.exe	86

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3956 set thread context of 2180	3956	powershell.exe	91

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3956	powershell.exe
3956	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4320	3956	powershell.exe	89
PID 4320 wrote to memory of 4180	4320	csc.exe	90
PID 3956 wrote to memory of 2180	3956	powershell.exe	91
PID 3956 wrote to memory of 2180	3956	powershell.exe	91
PID 3956 wrote to memory of 2180	3956	powershell.exe	91

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\mohafile.js
1⤵
PID:2360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w 1 -nop -ex unrestricted -f "C:\Users\Admin\AppData\Local\Temp\svc_37802_7674.ps1"
1⤵
- Process spawned unexpected child process
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mbwzqxz3\mbwzqxz3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES300A.tmp" "c:\Users\Admin\AppData\Local\Temp\mbwzqxz3\CSCDF9C70BE84A447B4831BF659852094B3.TMP"
    3⤵
    PID:4180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES300A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES300A.tmp
Size 1KB
SHA256 f1f87259e851c2c35ffa7d5505636f642e3ba53c8efa92c797b585fc8614adf4
MD5 150dc77f9464da559631dad72a89a31e
SHA1 f7305ddced7b23c0212cba2e2ad791ce0b995cba
SHA512 dad12ab5f84e6f289a20829edcbc25f16667fefd9258da05e2a87d13656ad22615130bbaa988b5e9360ca6a68d1be30278463d40f4d8abf76778f77a135d3bb1
TLSH
T1BA21CE0543FC471FF0B34B3279FA173BA674FD69EF62939A894042692C41500DEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

log_37435_7674

Path C:\Users\Admin\AppData\Local\Temp\log_37435_7674
Size 491KB
SHA256 482bb8d351879a6affa71383f6090ce42b56335752732a4086d6127c3b57e381
MD5 1592aea75a182d456891d8f3c816ac7a
SHA1 e0547d9f4ef8b5a0e2546e47ad035ddae22cf458
SHA512 48f2d61a65ac72d79ee9261568d089deb11fb3f8abd348ec12d7b2d536c043b67347daaf458d11c9acc2a8f9f9af9e946a97350ffc3b3824c7f1fd56237e9cc9
SSDEEP 12288:eAouAcCloB944lvB/5UXdDx6fClMqPiQNNrYkcE67c8pP:e3ov46B/Q6fCmOrNFY66gG
TLSH
T116B4124D4D35CA78DA981A88247E1F882FB40EC0947CBB8BF87670B75A8777720761B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbwzqxz3.dll

Path C:\Users\Admin\AppData\Local\Temp\mbwzqxz3\mbwzqxz3.dll
Size 3KB
SHA256 f42c5d84cf8a8224487f9954787228c08f2d69358021d14675abb462fdf4ba59
MD5 8756750ac6580baad1d11fa31f465be2
SHA1 89473c71fae6f9c089a7eecda79e06bf78958fbc
SHA512 3a9c103339b9986d6f6ae066349779d2c430ceaa1601fabc7b7bbacc21d34071f8380e67d3fe4d38718a059a72be6f2b4456068adea52a1fcfb2bc112fb68e3f
TLSH
T12B51A91B57E88A2BF0770B316DF347267BB4F8109BB2575E19905218AD616544E21FB0
MD5 SHA1 SHA512 TLSH

Submit Download

svc_37802_7674.ps1

Path C:\Users\Admin\AppData\Local\Temp\svc_37802_7674.ps1
Size 4KB
SHA256 7e4f6d4560485077b48756fc2004ae50acb14e552149ad5ad147a242b58554b7
MD5 023c37bff1d992e9cf9b35a94e58dc47
SHA1 52a6336694ce6e7117b86954cc72519a347783c2
SHA512 a840184400f3a0c424303831984847599707446bd6281df4b72dc111e49236fb6efbc2fb080c58a7539c072ee7146de784853f4d5c7ee9d56be7af6ecf20838a
SSDEEP 96:t3XKvn0un2ron8iQPL5o+M83wcL5GYmHkLcvcSdvBwDF8GgoGAIWoulDV8FJG:NXsn/nPn8iQDXM0wIoZHkLcvcSyUfYbl
TLSH
T1B79193497BEE45FA02C328B589664242BC98C82F011F0D08F26CD7E5FF67479C2FA596
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp_42052_7674

Path C:\Users\Admin\AppData\Local\Temp\tmp_42052_7674
Size 93KB
SHA256 9b261ff065b286f16281aa6dc3ec25d54fbdbda103d9c9bd07d1bb9a527e07ec
MD5 236988f3c7173067fcb2da60301e75c1
SHA1 41ce4476216fbc8d24c4556e11e0c513f988c472
SHA512 f056bce940d99140407b2ec8da9e1b7f996f2c7b1ed434e1944acb83f6cebdad02bc47a107fa72223a7ddf26e3be64c7e89c96a86f6a7296f2cc95b329f94b58
SSDEEP 1536:3orRmG6jHgy9zdDa0xyNhGjmZ0xOJMyEWZArZ5oNYG1Vuq8aKRQ352rlawP+x+Mu:3csjh9xDcoI0ly3UZo1kOgQ352r8w2xq
TLSH
T1D893020BCF618FAC9DB81D9838FC7BDA15519C840D24E9B280B934532BA336595EB79C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCDF9C70BE84A447B4831BF659852094B3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mbwzqxz3\CSCDF9C70BE84A447B4831BF659852094B3.TMP
Size 652B
SHA256 a01fb73be81eb13752597677f05310c40dfd394098586002a3dda60187eae990
MD5 a3fec2de68023e01c468e27c37de1210
SHA1 ac7e84ffe38d4f7cf04119b9dff3e31e6cf7b1da
SHA512 f34642a674d6f7fc9a612a88c3d1aded693c7772b90d433ad4200df491fde8e8196698edbb02cb00f841f0733b00540dffe4949df55bda5f830688d2e370d9c6
TLSH
T19AF05E0A63F8420EF0F34B30BDF697B395A8BC65DE3293ED1440435968649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

mbwzqxz3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mbwzqxz3\mbwzqxz3.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

mbwzqxz3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mbwzqxz3\mbwzqxz3.cmdline
Size 369B
SHA256 4236d511af1900902511c2425fd36a8aa7f87758229786b9abde0f735706b353
MD5 59b899b63f4ebaf8cf664405ace29236
SHA1 4171795842915979769dc6e1bac3dc0aee69c139
SHA512 a2deb425a79864f363de98bf7e7c916d35c3d43f02a178e8649774f75a86143b58aa5b1672efab0dda5e6b432a4b099c90760aec80c0ce8d13f14442e0d833c2
TLSH
T1C3E0202B539EC77E15DF940721E9C5BCCB7247472D427FC45150445DD01700467D1755
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3956-24-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-23-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-15-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-11-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-16-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-18-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-19-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-20-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-21-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-22-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-14-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-25-0x000002386A6F0000-0x000002386A704000-memory.dmp

Download

memory/3956-13-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-3-0x00007FFDBCE5F000-0x00007FFDBCE60000-memory.dmp

Download

memory/3956-9-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-8-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-7-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3956-38-0x000002386A700000-0x000002386A708000-memory.dmp

Download

memory/3956-6-0x000002386A990000-0x000002386A9B2000-memory.dmp

Download

memory/3956-39-0x000002386AA00000-0x000002386AA08000-memory.dmp

Download

memory/3956-41-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download