79ff78294d12ddede8fc5e64c4dea1d792f5db89867bb73704d5a32baf663c1c

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order ME83E0340340.js
Size 1.3MB
Sample260730-blf3mshh73
SHA256 79ff78294d12ddede8fc5e64c4dea1d792f5db89867bb73704d5a32baf663c1c
MD5 a1d33e7cad3e438ca6f37df1df9ca6d3
SHA1 484b3c0a3d766ebd306f3f6c0c53c98153678876
SHA512 ed37461f0e1775af48c6e95104260d495fd0e30159ec847bb25c7b578bb74224db40eaa9f370c8b5fee404113b618fba4d07a5ad5b844091f00ef8e1c5537339
SSDEEP 3072:ZfZ0Wvaxun+R4Opr5Xc41jq9pL9rB0Zuq7TW++T/G/BlwgxohFOxPxrVFc/8584d:C
TLSH
T19E55E67CCC18927EC2B3D629CFC78A07F8565817360DF94AA0D3735B9522293B8E256D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 16 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2892	powershell.exe
3	2892	powershell.exe
4	2892	powershell.exe
5	2892	powershell.exe
7	2892	powershell.exe
8	2892	powershell.exe
9	2892	powershell.exe
10	2892	powershell.exe
11	2892	powershell.exe
12	2892	powershell.exe
13	2892	powershell.exe
15	2892	powershell.exe
16	2892	powershell.exe
17	2892	powershell.exe
18	2892	powershell.exe
19	2892	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4672	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2892	powershell.exe
2892	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4760	conhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 4760	5896	wscript.exe	89
PID 4760 wrote to memory of 4672	4760	conhost.exe	90
PID 4672 wrote to memory of 4176	4672	cmd.exe	91
PID 4672 wrote to memory of 2892	4672	cmd.exe	92

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order ME83E0340340.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" cmd.exe /c "echo iex($env:WgJWfAqvsoqPH)| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w h -NOp -NOnI -"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\System32\cmd.exe
    cmd.exe /c "echo iex($env:WgJWfAqvsoqPH)| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w h -NOp -NOnI -"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo iex($env:WgJWfAqvsoqPH)"
      4⤵
      PID:4176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w h -NOp -NOnI -
      4⤵
      Badlisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-10-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-12-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-4-0x000001D36CD30000-0x000001D36CD52000-memory.dmp

Download

memory/2892-5-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-6-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-7-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-8-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-9-0x000001D36D730000-0x000001D36D78E000-memory.dmp

Download

memory/2892-1-0x00007FFBFB7DF000-0x00007FFBFB7E0000-memory.dmp

Download

memory/2892-11-0x000001D36CD10000-0x000001D36CD22000-memory.dmp

Download

memory/2892-18-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-13-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-14-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-15-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-16-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/2892-17-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/5896-0-0x000001B94E490000-0x000001B94E50C000-memory.dmp

Download