Analysis
- max time kernel
299s - max time network
189s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 03:21
General
- Target Purchase Order- BE2607-3463 -July-16-2026.js
- Size 1.8MB
- Sample260718-dwecxaew7r
- SHA256 18e848ff796023fdd1bda29e43efe6b2485dfe7c910a537463eef99c35a7cc27
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order- BE2607-3463 -July-16-2026.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioJS" /xml "C:\Users\Admin\AppData\Local\Temp\Task_51476.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w 1 -nop -ex unrestricted -f "C:\Users\Admin\AppData\Local\Temp\dat_79288_5a8f.ps1"1⤵
- Process spawned unexpected child process
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f1fyjxyt\f1fyjxyt.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES66BF.tmp" "c:\Users\Admin\AppData\Local\Temp\f1fyjxyt\CSC3E7761189FE24590BFF132B245EF1468.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES66BF.tmp
Task_51476.xml
clr_94386_5a8f
dat_79288_5a8f.ps1
f1fyjxyt.dll
net_25038_5a8f
CSC3E7761189FE24590BFF132B245EF1468.TMP
f1fyjxyt.0.cs
f1fyjxyt.cmdline
memory/412-38-0x00000231A9D80000-0x00000231AA724000-memory.dmp
memory/4792-14-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-26-0x00000252C13C0000-0x00000252C13D4000-memory.dmp
memory/4792-19-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-20-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-21-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-18-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-22-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-24-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-25-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-17-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-13-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-12-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-11-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-10-0x00000252C0ED0000-0x00000252C0EF2000-memory.dmp
memory/4792-9-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
memory/4792-40-0x00000252C13D0000-0x00000252C13D8000-memory.dmp
memory/4792-6-0x00007FFCF4D5F000-0x00007FFCF4D60000-memory.dmp
memory/4792-41-0x00000252C13E0000-0x00000252C13E8000-memory.dmp
memory/4792-43-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp