Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 05:37
General
- Target HSBC_BANK_PAYMENT_SLIP_MT103pdf.JS.js
- Size 3.9MB
- Sample260803-gbd37acf77
- SHA256 a2da5567a45a50560adb90e9d5795fa01208d3d06bc12d5f7aa3cca87dedd5a7
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\HSBC_BANK_PAYMENT_SLIP_MT103pdf.JS.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\TZXYUMGUWPMTOQSB.PIF"C:\Users\Admin\Documents\TZXYUMGUWPMTOQSB.PIF" C:\Users\Admin\Documents\TZXYUMGUWPMTOQSB.ttf2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TZXYUMGUWPMTOQSB.PIF
TZXYUMGUWPMTOQSB.ttf
memory/3620-9-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-18-0x0000000000C90000-0x0000000000C91000-memory.dmp
memory/3620-17-0x0000000000C80000-0x0000000000C81000-memory.dmp
memory/3620-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-12-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/3620-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3620-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp