ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba.exe
Size 88.0MB
Sample260724-tk2xtsgn5w
SHA256 ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba
MD5 6777a6dbd29e24616d60004627734c9f
SHA1 12d275a17741eb625133ac5a57eed297471e286b
SHA512 b3987f56d01d2c01bf3a64d3932a0ce7b1e2225d92ad2c706d81b8ca4bf5ca7aee735ade6ce221344b19137e17298b3ab0cc321390d303169d111583108dc5d0
SSDEEP 393216:d8nVxhanA6rh7CLBAwOdC1yJ8w65aPahY7ZZiRT4VpaUgPj1BiGUtlVpFzeBNsia:d8nvEA6rpCLBwb658a8ZZiOpgPVlcmK
TLSH
T113187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4132	powershell.exe
2584	powershell.exe
4456	powershell.exe
4496	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
1892	node.exe
3736	node.exe
4336	node.exe
4848	node.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\0be276c4-7dfb-4d5f-a8e2-fd7c5735c489 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\node.exe\" -e \"require('child_process').spawn(process.execPath, ['C:\\\\Users\\\\Admin\\\\AppData\\\\Local\\\\Temp\\\\tonrat_js_7f348c1e.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\""	powershell.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
4132	powershell.exe
4132	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	508	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5332 wrote to memory of 1892	5332	ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba.exe	89
PID 1892 wrote to memory of 1408	1892	node.exe	90
PID 1892 wrote to memory of 4132	1892	node.exe	92
PID 1892 wrote to memory of 2584	1892	node.exe	94
PID 3736 wrote to memory of 4336	3736	node.exe	98
PID 4336 wrote to memory of 508	4336	node.exe	99
PID 1892 wrote to memory of 4768	1892	node.exe	101
PID 1892 wrote to memory of 4456	1892	node.exe	103
PID 4456 wrote to memory of 4496	4456	powershell.exe	105
PID 4496 wrote to memory of 4848	4496	powershell.exe	108

C:\Users\Admin\AppData\Local\Temp\ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba.exe
"C:\Users\Admin\AppData\Local\Temp\ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Users\Admin\AppData\Local\Temp\node.exe
  .\node.exe tonrat_js_7f348c1e.js
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Temp\node.exe\" }).Count"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"0be276c4-7dfb-4d5f-a8e2-fd7c5735c489\").\"0be276c4-7dfb-4d5f-a8e2-fd7c5735c489\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "$code = \"require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tonrat_js_7f348c1e.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\"; $command = \"\"\"C:\Users\Admin\AppData\Local\Temp\node.exe\"\" -e \"\"$code\"\"\"; Set-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"0be276c4-7dfb-4d5f-a8e2-fd7c5735c489\" -Value $command"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Cryptography\" -Name \"MachineGuid\").\"MachineGuid\""
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "Start-Process -File powershell.exe -ArgumentList \"-c \"\"Start-Sleep 3; Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\node.exe' -ArgumentList 'C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js' -WindowStyle Hidden\"\"\" -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "Start-Sleep 3; Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\node.exe' -ArgumentList 'C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\node.exe
        
        "C:\Users\Admin\AppData\Local\Temp\node.exe" C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js
        5⤵
        Executes dropped EXE
        
        PID:4848

C:\Users\Admin\AppData\Local\Temp\node.exe
"C:\Users\Admin\AppData\Local\Temp\node.exe" -e "require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tonrat_js_7f348c1e.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\node.exe
  C:\Users\Admin\AppData\Local\Temp\node.exe C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Temp\node.exe\" }).Count"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 47cf72b4db0d175cfaacbf32f44a03cb3d8ef98c7bc6f6598a223368d68cc4f2
MD5 feeaf3dedee54fa09ae6bee080d8b07b
SHA1 bf758262f99c145704bc26fd7562dda7b96d3dd2
SHA512 58ca27ff8d7a442263fc52270ec9999eb64651db11df614fd8e6cc1d3e4491c1cbe72d153db74659eba0279f31432f39f77fada73efd1496910a9bb9a4f8d3d3
TLSH
T1E8115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D144B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aef8b020212d19e8c6e52e5f91f96126439e9399bc7e0a9ef369ab991df7b2fa
MD5 4d8c99ec83cd2a6919efa144d162b027
SHA1 aa79e7a4511aa03d04a00461627392e33733308a
SHA512 e2c555eaa487db38d46c7c71c27955d64337d43d856b29f38c5204517b0a26ce2ab04a2b516a42882338f09be09f9a5f7fedfb1e1071c4b92bac40dc7ef7fd09
TLSH
T165215733F3CC8624CC9A403650CEAC1036B687DB419EDF6BBB84D154A43F599DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b4d2605b3421911dd23b203ceda3c674f6e4c59b93f9c9d10ef548e2461a3151
MD5 e6a8d33648820752b04254098d837621
SHA1 a24310e320c2b6dddfb808db69565d1ca0276e6d
SHA512 01180b5c095bfa465388173f8e0b8d234982aa4e1589058889727894e15834c54b89c46f7ba8d26582841986db1e038fbe38f813ac75419995eb7e0891a6a432
TLSH
T114115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D144B83F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r5mmngwz.pz5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r5mmngwz.pz5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tonrat_js_7f348c1e.js

Path C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js
Size 402KB
SHA256 cd05fe39b73d3eab618ef2e6b6300f2a24d57d4e259b35647a909a7c616ffa91
MD5 33492f6f9af0deb485c6e5898ef2da2a
SHA1 3b2b37b106b33635870fee10ce160369f7cf2c0c
SHA512 3ee80d7ade2c16e3e87aa3e0c9b2761407043308ab887067f7a987c87d3457cf952add7f7fca863a922fb37164402784e2f532034d49afb5dd8318094bbf5ac3
SSDEEP 6144:SaZW/q1CAMmxkgZhta8NTQMnAydo+eNDRZYS+lXggNC8:6CCAHxk2ubWA+xep3YS+lwg88
TLSH
T18F942A4C2ACF7180917ABDBB3AF36555E7A84C81624899C8F9D03B2FFC2076ADC55B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tonrat_js_7f348c1e.js

Path C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js
Size 304KB
SHA256 7f348c1e4ee6c58f50e0cadd09b4ce8f0336cd968cf62b05c14aa7f78bdb7845
MD5 0fe2a01dc88eafc8530119885d4dbec6
SHA1 d6db6c0ba71d8f33b8fb34df8dbab567ef61529f
SHA512 5d96726983d7230a8aa12c7347e3d678b228b117c6a06e027096c5d571e4a04fc1ea1118f28680afdedb409f5c2cdc46ca20a0f640a05364947d139c8263586c
SSDEEP 6144:NyxhaFYCQEZh9a0As1mLXaZU7aGGdLFnXsBvOXfGqPa0:ya3Gx74MvO+m
TLSH
T18B64F78863CEB450117BBCF76AF26151FB589CA1D14850E4FBD477AFEC903398CA9A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1408-8-0x0000019DF7C80000-0x0000019DF7CA2000-memory.dmp

Download