76a5efb8c5ed5dae5516d4fd93a91f564b1b07d14f89fdadf5ec6f6e669636c3

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation Request – Purchase Order-19-07-2026.js
Size 1.8MB
Sample260720-dccpzac15q
SHA256 76a5efb8c5ed5dae5516d4fd93a91f564b1b07d14f89fdadf5ec6f6e669636c3
MD5 21b4248f19d3bb296eeb034cb8847a7f
SHA1 c39a9b22cf501202d27c21cd327c6b7c9a17af38
SHA512 82a0e806f187b6e554f44125f37755327e0c067aa95463236df76cc394a99987c029580e364c610010b4af78d0c267bea18639d568a7334f8931286f61570fc7
SSDEEP 49152:JfyhKtajByf0MBeuiJZXgYldD5CKjSubtSAm/VPogccNEbwWKZh5IWbpW:JfyhKtajByf0MBeuiJZXgYldD5CKjSu/
TLSH
T11D859D85D9355E5F9EF005B3B8CA5C919EE0E29C22E807F6F6C15C3A7B04D30849A6F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	5228	powershell.exe	85

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 2324	5088	powershell.exe	98

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	powershell.exe
5088	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 4648	5540	wscript.exe	90
PID 5088 wrote to memory of 3252	5088	powershell.exe	96
PID 3252 wrote to memory of 3544	3252	csc.exe	97
PID 5088 wrote to memory of 2324	5088	powershell.exe	98
PID 5088 wrote to memory of 2324	5088	powershell.exe	98
PID 5088 wrote to memory of 2324	5088	powershell.exe	98
PID 5088 wrote to memory of 2324	5088	powershell.exe	98
PID 5088 wrote to memory of 2324	5088	powershell.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation Request – Purchase Order-19-07-2026.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioJS" /xml "C:\Users\Admin\AppData\Local\Temp\Task_87327.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4648

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w 1 -nop -ex unrestricted -f "C:\Users\Admin\AppData\Local\Temp\cfg_86894_ba42.ps1"
1⤵
- Process spawned unexpected child process
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ihhaml30\ihhaml30.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES864D.tmp" "c:\Users\Admin\AppData\Local\Temp\ihhaml30\CSCC2295CE1557E420F8E1618FFD7A04989.TMP"
    3⤵
    PID:3544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES864D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES864D.tmp
Size 1KB
SHA256 8168664d7afa444377901ba44850747d707874e333a66c37aec7f20deb0a6e66
MD5 492341e943265629d258e5765deeb152
SHA1 590519b7eefb9bf8b4411bbfa6ca8703a2255d29
SHA512 7a0e822a23a3d302b9181bebc4b9bea7b52833d2b61067fc5e9e5499838fdad55fa0567122a17c4bdd21ae92bc39cb4e77392373220c4601a01f807d1adaf6e6
TLSH
T14321AB0163E9470FF0775B3169FA472BA664FD65DFB2939F848003282C41600DEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

Task_87327.xml

Path C:\Users\Admin\AppData\Local\Temp\Task_87327.xml
Size 1KB
SHA256 1eefba55277e6517b2a7af8194e09d910342468d8ef84e1bef2b49fc36923bdd
MD5 1709cf8fa7faae57139be6154366a98f
SHA1 266170d84bba9cc338e444a4ede14c614a4a15fd
SHA512 da9c35e2f184685b3d1d6ac3ee564aec13db2dc5efed3d514800596eadccf4705f485d4bfe7fd135e1c940edc6c4afc1503c7b0ef877f3f3d5fba9de636dd977
TLSH
T1DC41164367FE1109F1F3AB9CAAB758515EABBD594C34946D00AC060D0FB3A62C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

cfg_108194_ba42

Path C:\Users\Admin\AppData\Local\Temp\cfg_108194_ba42
Size 93KB
SHA256 1e55aef7418cf9562f9fb488f57c65d96f98d3ab095926d980392ab737ab0fae
MD5 9a7e99f0cca7b1962aacd760011e77e5
SHA1 215adb8841069242ef338bf6ac973b17760b36ed
SHA512 2cc491ab1e2d3add7cabeff03ef90bb646b06d67c6548e88da86fb0a7614d0f51c5c7baee29e408a6da36e01fab3f9398a87b223d689f2c47cf5a79cc27c7ca7
SSDEEP 1536:Z5iB8y60PuiLMFEzq8Jv+pqdL+nlafHTpC3+w1pq/OJjSepbJ6H1CISeVMMs8wDj:2Y1cq8JTdL8a/TpCntFSk41N1Ta/sf4
TLSH
T13B930245C431CE19DB90159C38FD069C3B50EE46901CDBAFB675D0B36AABE67301A176
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfg_86894_ba42.ps1

Path C:\Users\Admin\AppData\Local\Temp\cfg_86894_ba42.ps1
Size 4KB
SHA256 03b3b5c9bc194eb9b39808694316adb54a7378ed78e23a4a9da8aad181f75d30
MD5 5090c60855725b61f4dcfe50e23ebc57
SHA1 0adfa15127c45cc17fbfc056648c833d8fe7ca74
SHA512 70cefeba87fe51f770070077802b218104dff6bad15db9a2a7ad0c191169cf3b8eefc9eec3a5c0edcd4032832a2688248f4abe3e377cd25379f8a1deefee90dd
SSDEEP 96:+Ks3XKvn0un2ron8iQPL5DUAIMEiL5f5yD+jvMGV+GeskkLcvcSdvBwDF8GgoGmN:iXsn/nPn8iQD9UAIZyCDAv3kkLcvcSyZ
TLSH
T1B6A183497AED4AFA01C758768D620151B8A8C91F110B0E08F3ADD2D4FF57479C2FA59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ihhaml30.dll

Path C:\Users\Admin\AppData\Local\Temp\ihhaml30\ihhaml30.dll
Size 3KB
SHA256 1185546fec3df3e6af417027dbe3bd0536f25401b4fecb0d97cc135cdd1dbcfa
MD5 68130dc2d0db7ca2af901af287f0db0b
SHA1 363ebe8c9df0ab3acd0a46e9bb8b7e4feceb09ee
SHA512 4e38484e26b66fb1d10ed4708c50b0a9f55beb3d24e07e173bfaabe2925ed236d1c3cc53ea788dbd93334436b40fb87532cd0d2c02a46641de80bc601eed3de9
TLSH
T1EC51C91B67E88A2BF0770B306EF3471777A4FC109FB3A75E59904218BC216545E21BB0
MD5 SHA1 SHA512 TLSH

Submit Download

log_46366_ba42

Path C:\Users\Admin\AppData\Local\Temp\log_46366_ba42
Size 797KB
SHA256 efeb319c40ee16458c53e100ddbd3f68a4b13f41eaba53e5623caf0754906d69
MD5 9f95f96f90ce925ad21a4f9012866a2c
SHA1 d0f1f5e9fb1df9f392cd6aad0d13d43c5c7d7cb3
SHA512 a2a55618d43dc1a36129cea4c6c28ebb212b1e6995fe7b240fcb9a6b5f13ff4543c22ed10ff22be2ab8dd5b64e2848fe4c345648761ff3852411edb4732dcfde
SSDEEP 12288:nwDXGQfofgJvf9RDuepO6ESaEWb+uVwQAGd+u2ZWtlC4LQ1SNB2OT5gfeTooKoMo:irfegNFDPap6uVJXsdw4M7bGebN
TLSH
T1690512458A268D7982EC179C34BE0FCC2BE44F554068FBD7C57A70E74A9323630A75E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC2295CE1557E420F8E1618FFD7A04989.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ihhaml30\CSCC2295CE1557E420F8E1618FFD7A04989.TMP
Size 652B
SHA256 f83b98c9ad8ddf5b0edb679d96477d65d81c417c41a138ea858b67285890ff42
MD5 8c0b51a2b7ea5eef5bd1b747ea6c1b8f
SHA1 ad7766fa3c9540a45c5413fc07270de1814200d0
SHA512 0d0c2009f4cf5ad9b5fff6fc5b71c1086cd1dd2a70bf268da2e925ff7fdf31babd62fee3a6aaabaa563fa2189e66c966d65a1c1022b6744e6d25222e22602b48
TLSH
T1E7F05E4963F8420EF0F74B30BEF68363A5A8BC65DE3293ED2440431928646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ihhaml30.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ihhaml30\ihhaml30.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

ihhaml30.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ihhaml30\ihhaml30.cmdline
Size 369B
SHA256 3cd93ff264064c359e9eab19f23f1ebbd9487244209caa13d4228c47993b95ef
MD5 1d49fb49c32be3b731ae94c5c81408c1
SHA1 81a6a1c80f5a8301674f78fd1a92b167968288bd
SHA512 363592c007d4a2c28c138d8a3e195b38306c5769cb0daafbbcc45c58b3181b4d3ebcc08c217f80516e89b7424bb251581932dab2bb941b15591eb10cff3d3009
TLSH
T116E0683B464ACA7F01ED1007216DC8ACD6B20A4BADB27F845090470DD01701027D1F41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5088-10-0x00000133497B0000-0x00000133497D2000-memory.dmp

Download

memory/5088-14-0x0000013349810000-0x0000013349824000-memory.dmp

Download

memory/5088-27-0x0000013349970000-0x0000013349978000-memory.dmp

Download

memory/5088-28-0x0000013349980000-0x0000013349988000-memory.dmp

Download

memory/5088-30-0x0000013349B90000-0x0000013349CBF000-memory.dmp

Download

memory/5540-7-0x00000242DCF90000-0x00000242DD3AE000-memory.dmp

Download

memory/5540-3-0x00000242DCF90000-0x00000242DD3AE000-memory.dmp

Download