d9ae2b0f01a606a63f32c5d4100040ed6c990c99977f72b28efcd74c9a0b22b1

Analysis

max time kernel
299s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DP Invoice 57K.js
Size 1012KB
Sample260804-t1c9eavdma
SHA256 d9ae2b0f01a606a63f32c5d4100040ed6c990c99977f72b28efcd74c9a0b22b1
MD5 f3529f9b7b41579ef9c450d300780545
SHA1 d638e9d45dfc3f8f144b0bb8d2814fbc14d3d8e4
SHA512 6c132cdf25f18b7c189cd43fd74f8c28d0b38d380823d71f439fc06030eb014a34c976015059955569deb664e05a1f7c5237928f15816b8908d437a2f234a633
SSDEEP 6144:QsKrFBB7Gg9QrfetCYlZbRkKvXM9wpyha:m
TLSH
T1BA251D992385438CB03C866CEE6EF8A9828713E7FD93400DBD6641C1D7A6ED550F7E62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	3344	powershell.exe	89

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2332	powershell.exe
9	2332	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2332	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2332	powershell.exe
2332	powershell.exe
2332	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\DP Invoice 57K.js"
1⤵
PID:5952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:transcriptional"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x00007FFBCBD6F000-0x00007FFBCBD70000-memory.dmp

Download

memory/2332-3-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/2332-4-0x0000023E86FA0000-0x0000023E86FC2000-memory.dmp

Download

memory/2332-5-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/2332-6-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/2332-7-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/2332-8-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/2332-9-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/2332-10-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/2332-11-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/2332-13-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/2332-15-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download