94e8b56ca74e421e08e4843c1bc3319413dfdb0d1217df3b84a4c5a3fbb76184

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PURCHASE_ORDERS-Q4-2026 .js
Size 799KB
Sample260806-e4y8qax1cx
SHA256 94e8b56ca74e421e08e4843c1bc3319413dfdb0d1217df3b84a4c5a3fbb76184
MD5 1fe9af4555024c7b603fe66679f5b010
SHA1 b6d2a002a383017b992f618d54a90d3191836f16
SHA512 59f60930b628f2d3c12d73020867abc6a9ba866c5deb4e8268c2cabe0684ce1fd51057f646061163fed0a673f9eed04ca1c7e918113ae1e5f0efbc5ca485adf7
SSDEEP 24576:nhfuLUVjB4zpUM1H3CbViRvpzCVn0AxC1Sw7h/:n67wb50n
TLSH
T13905AEAE86687F690408F81D472F31C9EDD3C96A1B7BE2D8BF4A0F6F01175A0DAC5911
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1228	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
764	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1228 set thread context of 5248	1228	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1228	powershell.exe
1228	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 764	3256	wscript.exe	91
PID 764 wrote to memory of 1228	764	wscript.exe	92
PID 1228 wrote to memory of 3424	1228	powershell.exe	94
PID 3424 wrote to memory of 4848	3424	csc.exe	95
PID 1228 wrote to memory of 5248	1228	powershell.exe	96
PID 1228 wrote to memory of 5248	1228	powershell.exe	96
PID 1228 wrote to memory of 5248	1228	powershell.exe	96
PID 1228 wrote to memory of 5248	1228	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDERS-Q4-2026 .js"
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\s7aexi2n\clr_105829_6687.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\s7aexi2n\tmp_57648_6664.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bchmjtd2\bchmjtd2.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3424
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DEE.tmp" "c:\Users\Admin\AppData\Local\Temp\bchmjtd2\CSCCF418C9B59D3485B9769DBE7E5A29C2.TMP"
        5⤵
        
        PID:4848
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      4⤵
      PID:5248

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1DEE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1DEE.tmp
Size 1KB
SHA256 fb4161702a3fa25c9ca29129264c8e9c36ad53ce833684111abd34390f1d2a48
MD5 3a756ea01c2a42330d3dadea9f8f5b59
SHA1 25cb73abfc96c14399e70631c65099c04b0c6cb6
SHA512 f7a0aa1837502e9385987c7a0959318b9a88aed85bdc2740be9a70615b0bb6758ea3d0d896f153a6adfc24b8c1304244e65e83a14f6b85c2d9602c5f311deb4c
TLSH
T1E8216A0993E84B1EF0734731A9F6176F9674FD64EFA5A35A854042282C91604EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

bchmjtd2.dll

Path C:\Users\Admin\AppData\Local\Temp\bchmjtd2\bchmjtd2.dll
Size 3KB
SHA256 199da19f07b27234b21b0a49320f106b3fd6289e466844a2037b6076d522debe
MD5 3bc67556b731cb52a25025fecc502cd6
SHA1 45f35fcdb5cad153642e318e30eb662a177c396d
SHA512 f059859c0bf0d67c411ffa9804a321a3dc94a90c12ed8ba3b89e37d79c50b63390b4b814f5f4277875a7f76c447f59c83bc4f3bea4a985abb6d52c477ae3430e
TLSH
T1AA51C91A57E88A2BF4730B316EF3472677A4FC109FB2A75E1990422CAC607545E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

clr_105829_6687.vbs

Path C:\Users\Admin\AppData\Local\Temp\s7aexi2n\clr_105829_6687.vbs
Size 228B
SHA256 a468dee116f8f75ac0d7fee549af5e20c4e0a12dada1098e0d3337370fba25d0
MD5 289e14cd176f557a2eff69b48ecde7bf
SHA1 6e59e400751b995e4413e427e90a6634b215af28
SHA512 7bf62e0c43ad350c40d21beea2adbd90c0657c82ec6185bf3a77e210840fde38bddaa8504f9e175c493ec1f11517b3c4c7fb627ca1233e2829cb573dcf8f166d
TLSH
T196D02311E13DD31CCD25C47A40F3927CC5E3547D21845B616750B904F5C17B9CE59349
MD5 SHA1 SHA512 TLSH

Submit Download

dat_45099_6662

Path C:\Users\Admin\AppData\Local\Temp\s7aexi2n\dat_45099_6662
Size 48KB
SHA256 896006df83225c127062d1ab63f7aeb04649cf4b0984766875a10b0954555724
MD5 b7bf3fd617b0d98822a862858b9060e7
SHA1 b1b0473824188317f5154e1e2a5be90492b49cb3
SHA512 c1f0d8b23ece6179680f6f782b640b3d0c43f63bef0075128b8b7ecab53a1382c64b751b2b1faf16e3ef4194959fc0de48bd28dcceae335ebbc01874425e6943
SSDEEP 768:bMcDbSuRPUdhYOs68SLnflvI4VbcxsLt3IaErHLpaJCqfbXUHv18WXEQD4xQGuF6:PBRGYOllLntQ4dSRAffbWN8AE5+NKGXe
TLSH
T1972302B5DD08131E67C876903375F30A93C9DE0AE25AB23A354050976B6E39738F89B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_87373_6663

Path C:\Users\Admin\AppData\Local\Temp\s7aexi2n\net_87373_6663
Size 314KB
SHA256 ab6ebb6f3c8bfcde005359d972ae8f1b5c72baf8b977092335b7fb3ddad9baa2
MD5 edd2da94ae666dc390419cbd4c3cd05a
SHA1 e13a64467023b53669976eadf1fd768f8cb4b05c
SHA512 8f4d42f8bb81f34ab3b08de3246bf939eb91bdece1f46f91d92979f08c1f3cdc106c73a450bc982c0aa1d45bdad8a5bbdf19e3868d5fc7cabefdf7d60baef342
SSDEEP 6144:7KTE5oao2PI5n2nAGo7tLWJtV4+KKbxQMrd9nEK5xAqNC6TfYuh+:7bo3N2nq7tKJzXVNEuykC6Tf+
TLSH
T115642309CE7C8CAE4558123B206E4F4B67D18948B134E7F136F63D86B58FF98D4494AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp_57648_6664.ps1

Path C:\Users\Admin\AppData\Local\Temp\s7aexi2n\tmp_57648_6664.ps1
Size 5KB
SHA256 fea31f973b830c49f8ed3d9766f473e633cbf9c1ab2e0b9cca79c9fee1d4cb0e
MD5 24c4fa078e0e450dd5fec16eea0e46ea
SHA1 18985d5c1f2d1bec61db322b52b04f013fe5e143
SHA512 8f398311c9a3468197d63921df7eff4585412dbdbb1eb941ae30ec39ced8f418cc78f61bca419e6fa21da898f6112b8829e2143f6b1d590356e9acddbe7e2018
SSDEEP 96:aJcQulO9GG3z5Xayg9GUij/f5H53y1f5gOL4GIoBY67tKhwwDzm8CgrcXqHOpoux:gmOEG39XaygEUij/fxpy1faOLZIomItF
TLSH
T15AC1730A7ADA4BFE03C374755DB21541F269D02B264F1D00F6ECC6C6AF02534D7E52AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCCF418C9B59D3485B9769DBE7E5A29C2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bchmjtd2\CSCCF418C9B59D3485B9769DBE7E5A29C2.TMP
Size 652B
SHA256 6dd13a5be517e18b2f12f77fe02aa9c95245f5b3d1762a929469be28afdb2a6b
MD5 c87772e9bcbf2a7e2975a0dfb44a25bd
SHA1 fd6b5a1aba4b9da55f9249811cacf3aec6ab9dcf
SHA512 b2dee99f775a3305ebc473b1b492c1f7295eee972290509dfcc201c3ae9b13d919318091d1c8044e8d49070e3aeed39b1d8f84460b78e514e53d30d624c3d64c
TLSH
T1FBF03A0963F8420AF0F34B30BDF643A3A5A8BC64DE3293ED1480431D2C64A109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

bchmjtd2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bchmjtd2\bchmjtd2.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

bchmjtd2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bchmjtd2\bchmjtd2.cmdline
Size 369B
SHA256 2ab7f6778303ec93713fa33c873a776627c1b19cb85e1dd4a8d1db7ffd66757f
MD5 5411320d8050b0b83bcef47509e40ce8
SHA1 718d1e56f4f6de93ad178df718ee7bfd7394dfa0
SHA512 01015b71391c8ec38afd91349ab92bddc9d5891ae3c0b3be64e8b451b94e570b533b9cf0689acfa770b940901ad3dddce5e37b873edc9c7ed281e1fbb70759c9
TLSH
T1CDE0C02E42E6C27D2DED100F216DC4ECC2720B432E40BF9C5044446DD497D012BD1761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1228-12-0x00000170E9B40000-0x00000170E9B5A000-memory.dmp

Download

memory/1228-6-0x00000170E9AE0000-0x00000170E9B02000-memory.dmp

Download

memory/1228-25-0x00000170E9B70000-0x00000170E9B78000-memory.dmp

Download

memory/1228-26-0x00000170E9B80000-0x00000170E9B88000-memory.dmp

Download