866fad8368e2082b72ef6881761f09aab649e31e587b5384e43b716d67231ced

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RVC F-1500-320-15.js
Size 2.4MB
Sample260716-p7hp9ahy21
SHA256 866fad8368e2082b72ef6881761f09aab649e31e587b5384e43b716d67231ced
MD5 940dd5816b79f176f9d8d44b7fc187f9
SHA1 2883d635873a1472343469f5cbd75ae819af21bb
SHA512 f386f4b4101a8d7c860b4c0042d89539f7a51e68fa377388e1f1036cf5602d1953656ad0cee6a244f28f90da6a3a5bac0e705eae66f8485e3129f05a3c5296ec
SSDEEP 96:NfZIZa01XZguTxii2/aIOmgYHmRLS701hiwB1QqEEj22l6F7O6ZOhL:da40JmPi28TYHAS70/iwBqqExKsO
TLSH
T1E3C512293666304E24F3B4B84C64D5AA5ACC7118B2013E9CAFFFF6A5254A5CB59F3037
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5732	5332	powershell.exe	86

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5732	powershell.exe
3	5732	powershell.exe
5	5732	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5732	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5732	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RVC F-1500-320-15.js"
1⤵
PID:1112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:neoprene"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5732-0-0x00007FF9021EF000-0x00007FF9021F0000-memory.dmp

Download

memory/5732-1-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-2-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-5-0x0000026048F10000-0x0000026048F32000-memory.dmp

Download

memory/5732-6-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-7-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-8-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-9-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-10-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-11-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-12-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-13-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-14-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-15-0x0000026049430000-0x00000260494E4000-memory.dmp

Download

memory/5732-16-0x00000260490A0000-0x00000260490AA000-memory.dmp

Download

memory/5732-18-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-19-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-20-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download

memory/5732-22-0x00007FF902060000-0x00007FF902A04000-memory.dmp

Download