22557fc0d540d262911fc0aafb8bd373e22b8829ee4f72ed4771ce4c1122bfd9

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dap_3.1.61.js
Size 10KB
Sample260806-27jc1ack2x
SHA256 22557fc0d540d262911fc0aafb8bd373e22b8829ee4f72ed4771ce4c1122bfd9
MD5 034583321fe042b0e45141a83b60b546
SHA1 a16212cf1a108ac4d1aae5451bba0f7f2ba6aa1f
SHA512 e5c07c3f3aacdaebbf64977ed1563d6d650f7719f8a455941694ed486e851c1a12d4922e1c3d415317acb18e978515b4bbf7af2421ebe5ed5330d5f1b7b9a3c7
SSDEEP 192:M+Sh05jA0gLsMtLMpV5jaZwdpnjORj+VPgdLZ:M+a05jTgQMhMpp7jORj+VPgtZ
TLSH
T1172225D47AE6D54B5BCD0993FD24CDD910B2962660C4F257C3ECF98E14AE28BCA2D8C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1240	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1280	powershell.exe

Deletes itself 1 IoCs

pid	Process
1280	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	powershell.exe
1280	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeIncreaseQuotaPrivilege	1280	powershell.exe
Token: SeSecurityPrivilege	1280	powershell.exe
Token: SeTakeOwnershipPrivilege	1280	powershell.exe
Token: SeLoadDriverPrivilege	1280	powershell.exe
Token: SeSystemProfilePrivilege	1280	powershell.exe
Token: SeSystemtimePrivilege	1280	powershell.exe
Token: SeProfSingleProcessPrivilege	1280	powershell.exe
Token: SeIncBasePriorityPrivilege	1280	powershell.exe
Token: SeCreatePagefilePrivilege	1280	powershell.exe
Token: SeBackupPrivilege	1280	powershell.exe
Token: SeRestorePrivilege	1280	powershell.exe
Token: SeShutdownPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeSystemEnvironmentPrivilege	1280	powershell.exe
Token: SeRemoteShutdownPrivilege	1280	powershell.exe
Token: SeUndockPrivilege	1280	powershell.exe
Token: SeManageVolumePrivilege	1280	powershell.exe
Token: 33	1280	powershell.exe
Token: 34	1280	powershell.exe
Token: 35	1280	powershell.exe
Token: 36	1280	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 1240	3324	wscript.exe	90
PID 1240 wrote to memory of 1280	1240	wscript.exe	91

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\dap_3.1.61.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\dap_3.1.61.js" /elevated
  2⤵
  - Badlisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$di=Get-DiskImage -DevicePath \\.\C:;if($di){$p=$di.ImagePath;Dismount-DiskImage -DevicePath \\.\C:;while(Get-DiskImage -DevicePath \\.\C:){Start-Sleep -s 1};Remove-Item -Path $p -Force}else{Start-Sleep -s 5;Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\dap_3.1.61.js' -Force}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-0-0x00000229EA230000-0x00000229EA252000-memory.dmp

Download

memory/1280-5-0x00000229EA2E0000-0x00000229EA2FE000-memory.dmp

Download

memory/1280-6-0x00000229EA5C0000-0x00000229EA672000-memory.dmp

Download

memory/1280-7-0x00000229EA300000-0x00000229EA30A000-memory.dmp

Download

memory/1280-8-0x00000229EA330000-0x00000229EA34E000-memory.dmp

Download

memory/1280-9-0x00000229EA310000-0x00000229EA31A000-memory.dmp

Download

memory/1280-10-0x00000229EA320000-0x00000229EA32A000-memory.dmp

Download