dc114a3f6fa295dbae5b0b601a66e57505b74b70a773d71f9ea1fdc3b6673349

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Consulta de compra.js
Size 774KB
Sample260804-k8r8vsgf95
SHA256 dc114a3f6fa295dbae5b0b601a66e57505b74b70a773d71f9ea1fdc3b6673349
MD5 3769a0c9db4b24d9781dc234e1fb694e
SHA1 34687c8364a53ad706429df42c05522bc1cf4078
SHA512 4cdcd714278f164e02dc2df417e6bf026771f9e5fc91466767cf4362a957a3f97f0199f1cb63c887052c34f88bdea0c75509c7526b04533cf3d0c6489124d282
SSDEEP 24576:5K8VKp9OoQRUTS3CAhcNzPPQm46oiWUX2:5HqKnc54DIX2
TLSH
T115F4AEF0F5F1A0A411D4CE389A7E63027494B07B1E2186A6B571AC4EF25CB53D9D28BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4168	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5976	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4168 set thread context of 5036	4168	powershell.exe	97

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4168	powershell.exe
4168	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 5976	4588	wscript.exe	92
PID 5976 wrote to memory of 4168	5976	wscript.exe	93
PID 4168 wrote to memory of 4564	4168	powershell.exe	95
PID 4564 wrote to memory of 852	4564	csc.exe	96
PID 4168 wrote to memory of 5036	4168	powershell.exe	97
PID 4168 wrote to memory of 5036	4168	powershell.exe	97
PID 4168 wrote to memory of 5036	4168	powershell.exe	97
PID 4168 wrote to memory of 5036	4168	powershell.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Consulta de compra.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\eftkg938\clr_18001_1bac.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\eftkg938\clr_90444_1b7a.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xek5j22a\xek5j22a.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3649.tmp" "c:\Users\Admin\AppData\Local\Temp\xek5j22a\CSCCD24E09740274831BE6C3514C1BF94FD.TMP"
        5⤵
        
        PID:852
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
      4⤵
      PID:5036

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3649.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3649.tmp
Size 1KB
SHA256 105c8f486e3cc8766e1738c3ca6eec63655c9deca8ff1965a3a37c1e943c7ce8
MD5 d0b5cca1a72143ec5c2eafd197844e01
SHA1 bccbf49a5532483c44c225fabf2049e47b2b695a
SHA512 7a20b1c5a84fdd6db3a5ca03ef8e754d7f258daf03cd100b82135ba5a105e6cce196e6b25c6fd76dab8ecc61cb626aa49e1104fc28e8db0fa6d68b26242b8c60
TLSH
T1CB21EF0993F8870FF0778B3169F6071F9274FD58EFA6A75A848102282C02144EFE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

cfg_22660_1b78

Path C:\Users\Admin\AppData\Local\Temp\eftkg938\cfg_22660_1b78
Size 298KB
SHA256 070eb5d85645aebcc24009d7adad989e329b19395386a61c401ef83105e205f0
MD5 827b17abc8795c28a1e369d887eeb902
SHA1 071097437806cee44d6ab5350f0fef98e3735aec
SHA512 cdef88126d54c8d97b67fcdb057d7995cd0130c2ad471c49e5b210034f99189be5ad26c223163e0ea1016c21e24151c0384fdf640762b0ca90edde318b3cbcc1
SSDEEP 6144:BC+eiI9dbq5P85JEm56lK+6GqCtK+2TBF2DptxZWTwd7POorZQ:BXS9qR8ilK+SCUDTyptwsXdQ
TLSH
T1E95423066BB99F1E13BE4BF820281F0F77F498414A48AEC3F796D86C58417D460A75EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clr_18001_1bac.vbs

Path C:\Users\Admin\AppData\Local\Temp\eftkg938\clr_18001_1bac.vbs
Size 228B
SHA256 7ceb9c808c71b716454f18cd9854863209e510e678c6d1efe485b22da1933ed6
MD5 5fc3a646d26fd01fa0cdd6bb796b3efc
SHA1 a578d5321047d00b4dc13a3d134acc3cfbc9a7b6
SHA512 cc52db7fc5e013f2c1517aed8a5af28750d93bdba4a32545a7dbc96c3596717e007cbdecaf2eaba37c8cfd002cc47622569660907d83ed801a33dc7af271a88f
TLSH
T126D02300723AD20CDC2DC4750073C23C84D3E87C2300172123609404F982178CE6D248
MD5 SHA1 SHA512 TLSH

Submit Download

clr_90444_1b7a.ps1

Path C:\Users\Admin\AppData\Local\Temp\eftkg938\clr_90444_1b7a.ps1
Size 5KB
SHA256 f2e3a03888acc5bd4b002a7f1c901cec315af67d087e773b497a3b03d951a4f7
MD5 264d6ad3beae2491c0923576fab3117c
SHA1 8d714412108be20d6f1f3d53b71ea55351439a46
SHA512 0c45bad7009f5246a120cd327a4855fbbca3afbb858291ccaeb18b153952c303667b67e3996126b2bec4798c5d8f7dbf4750270c780b6fc6509e6c02c586eaa0
SSDEEP 96:aJcQulO9GG3z5Xayg9GUij/f51oLO3f5qe+3T7skYiGIoBY67tKhwwDzm8CgrcXW:gmOEG39XaygEUij/fbYO3flmMkAIomIK
TLSH
T14EC1840A7BD94BFA02C3707559B65552F279E027221F0C04F6ECC6D5BF02434D3E62AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_100829_1b77

Path C:\Users\Admin\AppData\Local\Temp\eftkg938\net_100829_1b77
Size 48KB
SHA256 cac54687b3094729064c19f3f9c162d92643c8e745132b6ef140f229d20e7875
MD5 3aafacc21e6057e20e3eaec7194f9a02
SHA1 e844e4768e80f652838e25a4c4bbe6dac8d1933c
SHA512 6806f97d2ab7d77c632eac359e05dfc86eb6f528cf25a5eb94bbfc862bf983c39d5dc17866273d27c0dcbd9497d3e956023b5ea77ce2daeaf0cae4d68aee41d4
SSDEEP 1536:HDSN1YQsp6PGMqR5Dv00Jxel8ot+KaHH2:jg1YQtPFqzDRJxeOotmW
TLSH
T15923F109CDAEE12E55477B7FC2E6AC2F329119BC540C93F9864B36E84A2B14911E74FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xek5j22a.dll

Path C:\Users\Admin\AppData\Local\Temp\xek5j22a\xek5j22a.dll
Size 3KB
SHA256 45615895d6bfb3b64dab0a7bc54a5e5bf1ab1105dbba2bd724a30c1790088249
MD5 59a03e711d2a9b5d63c34cc57a9b68d9
SHA1 255ef92bf155ae348e49b3d480f86dcbdba27ffd
SHA512 0978a20fd10a68d28cee4b49f00e2a4f2e4d457f43c6045b1eadaef0ddec9a3a741cb2ab29e2496fafb128468c2d2f50caef2a3030dbf964f0e2eb3a501bf979
TLSH
T16351CB1A67E8862BE0734B309EF3472677A4F8509BB2575E5D904218AC216545E21BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCD24E09740274831BE6C3514C1BF94FD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xek5j22a\CSCCD24E09740274831BE6C3514C1BF94FD.TMP
Size 652B
SHA256 540a8b04a0eb1202d91d858b2f00babe69acec6e7b456d21e3df580661caac7c
MD5 6a774b55b2714008b3ceec05c9430ae3
SHA1 65d77a56e4489999cf90bc378762b2586900de1e
SHA512 6d59c764ffed9c007a6257e778b6d4de2743d942df83c6121ed8d414edb9514301dc518efc85261e37b3ff1c82d1d397a6aa50741822610849db4301f7c70333
TLSH
T158F03A0D73F8520AF1F38B70BAF6436391A8FC65DE3293ED1491031928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xek5j22a.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xek5j22a\xek5j22a.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

xek5j22a.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xek5j22a\xek5j22a.cmdline
Size 369B
SHA256 0ffc5e22d47cceed274426bad9a847692178c31e54d530db903b809183436d86
MD5 95f1ccf601cef2e1f14348c99212ab5f
SHA1 08a986ff74eecb33114fb69a3d93be3e8432e607
SHA512 43fa7e816af35cbf1618f6c119d7d7991650ead2d7a3390d1010596836e35d2db19becfde9a801f9956c0f0c249c74c0e8144b0cee43975d7e3605f00215bebb
TLSH
T167E06F3A4266C27D01E9200B226BC9EC9272A6C33EC03F84D088C80DE03B2003FD27A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4168-12-0x0000013F6FAB0000-0x0000013F6FACA000-memory.dmp

Download

memory/4168-8-0x0000013F578E0000-0x0000013F57902000-memory.dmp

Download

memory/4168-25-0x0000013F57950000-0x0000013F57958000-memory.dmp

Download

memory/4168-26-0x0000013F6FAD0000-0x0000013F6FAD8000-memory.dmp

Download