4f5858701ec0504f3c03d890c82ae72a749d8b2b3d48c22db81610c9e9865d7a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO Submission-Q4.js
Size 773KB
Sample260805-csnlqsca88
SHA256 4f5858701ec0504f3c03d890c82ae72a749d8b2b3d48c22db81610c9e9865d7a
MD5 d10243cf8a34e0229b972b608ad90d2d
SHA1 47fa14dc6e08bb69ec307158053c7fe91ed9560e
SHA512 c9499fff0e5123adf3093e8c02a3f118becd0b056b49a45bc19bfe1b6bb598485ad68cacb905001bb1d063603ffe6b43937141abc1f794250dfbcfea2cf8c71d
SSDEEP 24576:A/HP5GQi8hchjtU/ccpT3e5HjpwQqmwfGdo0:QOhkBmwc5
TLSH
T176F4AF39E4E1468D972D8709592FADCC706468FA4862E09C5DDADF490B3ECC8F779C22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5672	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2600	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5672 set thread context of 2164	5672	powershell.exe	97

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5672	powershell.exe
5672	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5672	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2600	4136	wscript.exe	92
PID 2600 wrote to memory of 5672	2600	wscript.exe	93
PID 5672 wrote to memory of 4168	5672	powershell.exe	95
PID 4168 wrote to memory of 4572	4168	csc.exe	96
PID 5672 wrote to memory of 2164	5672	powershell.exe	97
PID 5672 wrote to memory of 2164	5672	powershell.exe	97
PID 5672 wrote to memory of 2164	5672	powershell.exe	97
PID 5672 wrote to memory of 2164	5672	powershell.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO Submission-Q4.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\qkl6e8s4\net_36412_8066.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\qkl6e8s4\log_29178_804a.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lt5uiqfk\lt5uiqfk.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8207.tmp" "c:\Users\Admin\AppData\Local\Temp\lt5uiqfk\CSC181D22B44FBB4F6EB43044B0247BDCB9.TMP"
        5⤵
        
        PID:4572
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      4⤵
      PID:2164

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8207.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8207.tmp
Size 1KB
SHA256 1431b388a30827da4c1b97fdf9c76ca30c12fefbc87f44c5387b3ab9bcb873a6
MD5 7a90dad68d7bcdf4a138ebeecd81c2b0
SHA1 c9835f97dfc6c7ff2f1d76bf8d2280b61692e5a6
SHA512 fafeefcf3fbc71fded27744182dce0b543f7c1b6008b360a4336c10956d2c502cbc6f14912ae2276e9b77be8af9bd58602c36ffd05cbe0f007a6fa243c44d9ad
TLSH
T14F21020593E98B1FF073473169FA172FA238FD55EFA6976B4981422D2C51104EEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

lt5uiqfk.dll

Path C:\Users\Admin\AppData\Local\Temp\lt5uiqfk\lt5uiqfk.dll
Size 3KB
SHA256 8434c00594a10aa255715d4231ed972a3c16cd39bac0d1a5d2e0734b4b7f4643
MD5 b7b2eb0d05e3e0e11c60055fa83ef9b7
SHA1 379fb5d6b089fbd6f55e32d688d2087ba41bf143
SHA512 4faa2e23621b27974afcfd5163008f1cd30d1c01876d046930b5dd151fb783007d7551bf214239f2ba342f2e55d3e653bd2aabb5a43ba86ad954671557b3fc12
TLSH
T1C451DD0A9BE98A2BF4730B316EF3471777A4FC109BB3A75E1D904219AC606549A31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

dat_67172_8047

Path C:\Users\Admin\AppData\Local\Temp\qkl6e8s4\dat_67172_8047
Size 48KB
SHA256 c5d011767fe53202f3c6579ec3104515deb8f13b635db88238c3ab53ce57f901
MD5 beb480b3a8b804b04135d7a57612e6a3
SHA1 395b3463c73af13a552bbf49ac0f058ad6156d13
SHA512 8d53ebd864addccd7353ffb66f35f2057b510c703b6d31e62b4036d467da5374233102654da6fdaf253dcdb0f228a67eb478bf17659567dda385f16e2ca86986
SSDEEP 1536:8zPi8RSRpeuVRQtGLb+oVPo3+L+Z5R144dSMEV9W:cPFohkOE3rZ5344dSMs9W
TLSH
T1CB2302A759A88F470C40E2CF899706E56A3C880481A8DCF74AF7FC8761EFD19A59371C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_29178_804a.ps1

Path C:\Users\Admin\AppData\Local\Temp\qkl6e8s4\log_29178_804a.ps1
Size 5KB
SHA256 9d2922853552ca1e14ccd1f3592ae24f55d58ce76538a7ce8d900807e8bf29fb
MD5 7d15eca3c9d55d9ba902b70ccaadfeed
SHA1 4925a10febb92567ce86d9ae3fa3f182cd12b434
SHA512 1e9fc929eb2c9258b77681cc42b0294b7351c272dc2c03820753efce520c0cf3618ba5dbbde404b4b40e34557f21633e930e0ad10868ede3ee5b24b6fe1d939c
SSDEEP 96:aJcQulO9GG3z5Xayg9GUij/f5L4f56gS4AthGIoBY67tKhwwDzm8CgrcXqHOpoup:gmOEG39XaygEUij/fl4f2Bt8IomItKha
TLSH
T119C1750A7BC98BFA02C3747589B61552F278D42B220F1C44B6EDC6C9AF46834D7E51AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_33626_8048

Path C:\Users\Admin\AppData\Local\Temp\qkl6e8s4\net_33626_8048
Size 298KB
SHA256 99a142613e35f40bc8c364f81f5fe8047d89865bc283c83571e49473b2e493d4
MD5 9387e1618305746029eeecd5f66a1063
SHA1 6b4ed9e00fdd83b2053364ffa92f0203c0d732fe
SHA512 618b55291a15fb0036b3adfd8344b31d5acf1ad8d186554dd9d055591b755f9f8cd3c6f7e2d0833429e7c2bf5c33924d47db6b7d596b6e9d0bc75017c60b30b6
SSDEEP 6144:4dirb05FA/FWMWc/CG8VPJPXnwmI2v7DFxeWvU+ZrljBHUNlhb8LvOj:4UrbUF3Hc/ZIPJwfkJhZddCld8LWj
TLSH
T1A854231ADE761F0DDBB2162624B60E4CB8B0CD60C0F07E6A55932B5B746DCEB670B487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_36412_8066.vbs

Path C:\Users\Admin\AppData\Local\Temp\qkl6e8s4\net_36412_8066.vbs
Size 228B
SHA256 f905daed9d8aa25ead1cc99682f1836a6359b5dd56d5907e46a9f18783e1a982
MD5 f3b7320d7b3d2991575f5caa66f16709
SHA1 509b0db684e78e99ef0982dd58f02f0f94252186
SHA512 27477dae724fdd35373a2835fea8b3186407eb73c0a3ddc68af51350408891fa0fee0ff35df3547aeefdac427a550a7ae03a068d39b9c1322bdadf416d70514a
TLSH
T145D09710A23DE30CCC24C83B80A2872C84A398586100575123509D08BA85678CE59208
MD5 SHA1 SHA512 TLSH

Submit Download

CSC181D22B44FBB4F6EB43044B0247BDCB9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lt5uiqfk\CSC181D22B44FBB4F6EB43044B0247BDCB9.TMP
Size 652B
SHA256 1d781b61efb4519f4f8709d27a9eda4ed53007ba81ab576e1c42c41ace635dcb
MD5 63eb8dbaae4c292bf363eacb12adbe04
SHA1 0bfc61cd07e283f5da1e1f869b4cd1a1e8626c6c
SHA512 6b161f2cca9272e6ce59cf7994b6f9ce1b62005b28c2489383217125dc8b798c32207d7fa01c11cc25ab3f33fcebae7e27a949530dc665107913f789522eceb0
TLSH
T18DF0824963F8420EF4F34B70BDF6436391A9BD65DE3697ED1880031D2C64510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

lt5uiqfk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lt5uiqfk\lt5uiqfk.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

lt5uiqfk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lt5uiqfk\lt5uiqfk.cmdline
Size 369B
SHA256 3937915eaedebc9cb46d06d3fb40b15dd98ce50c84d9d9d084d7bf839ef76163
MD5 9babdd39310102902ac29cfb321d71b1
SHA1 3009f85f89a3cf56a2dbe5eb93bfc8d2db9d5a44
SHA512 9f84c7b173c7431ac0ee6e1ffc6de2417c72f71e94af8ae47cea1731fee54b6e66ca41733a561ca056e21ef6e68f54f5a964c3595bb68172def5cc7b2d71c9ca
TLSH
T19BE0C02E5257CA7E01DD10173169C4ACC77227433B407F885840CC1EE017004A7D1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5672-12-0x000001D5A6880000-0x000001D5A689A000-memory.dmp

Download

memory/5672-6-0x000001D58E730000-0x000001D58E752000-memory.dmp

Download

memory/5672-25-0x000001D5A68B0000-0x000001D5A68B8000-memory.dmp

Download

memory/5672-26-0x000001D5A68C0000-0x000001D5A68C8000-memory.dmp

Download