3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00

Resubmissions

15/09/2026, 11:29

260915-nlkgaatzg1

07/08/2026, 14:21

07/08/2026, 14:20

06/08/2026, 22:19

06/08/2026, 22:01

06/08/2026, 03:44

10/07/2026, 00:11

Analysis

max time kernel
599s
max time network
606s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js
Size 193KB
Sample260806-ear8baff46
SHA256 3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00
MD5 421bdc206ca515eff10d9019e7d6682d
SHA1 61d69fe41176f9dcf84fcc451cd3375d55b277c6
SHA512 d1ad2b34cb8f816468839ed38fce1ea9ca7bae14a30807832d2c108608ecfc2b1f9cec1e5254b6bbae0827b3f2944b504b750d3f6a3499bcdf2847d2aabb9507
SSDEEP 6144:GpdWeXigeXFd1LdkiOBvRZRHFPAeRnAklgF2GuuZD:4Sd1LjOJ7dTtl029q
TLSH
T16F14A07B690AFDDDA7762AC090292615CCDDB60B1308C158FACCB5483F76160CFBA976
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 29 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2984	wscript.exe
6	2984	wscript.exe
11	2984	wscript.exe
16	2984	wscript.exe
17	2984	wscript.exe
18	2984	wscript.exe
19	2984	wscript.exe
20	3360	wscript.exe
21	3360	wscript.exe
22	3360	wscript.exe
24	3360	wscript.exe
27	3360	wscript.exe
29	3360	wscript.exe
30	3360	wscript.exe
31	3360	wscript.exe
32	3360	wscript.exe
32	3360	wscript.exe
42	3360	wscript.exe
47	3360	wscript.exe
50	3360	wscript.exe
51	3360	wscript.exe
52	3360	wscript.exe
53	3360	wscript.exe
54	3360	wscript.exe
55	3360	wscript.exe
56	3360	wscript.exe
57	3360	wscript.exe
58	3360	wscript.exe
59	3360	wscript.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js\""	wscript.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
18	pastebin.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3360	2984	wscript.exe	89

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js
1⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js"
  2⤵
  - Badlisted process makes network request
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - Modifies registry class
  PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1652

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uLekaxYr[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A4AL14AO\uLekaxYr[1].htm
Size 173B
SHA256 5bd1cb20b56bb3ea06d9c3f0abe9223a38e93f3d833df496524dcdebfeb3b4ca
MD5 bcd560eba80b849c980a5123047bc8f8
SHA1 cfc17fc5f3743042a8e00ea8d8b2a1e17a739f89
SHA512 1fcc48ff7443592fd8bc612d9625171563bc1c6a31d825fbf1fa888e4102b1ff0616a425f5d59bb7784a671d86bbf0cb637a98be95de8c94a98dfa9a13349a2b
TLSH
T176C0806D6B533C9874973B3950C39160E1DC503023D9041112704507F0CB1D78DC23D1
MD5 SHA1 SHA512 TLSH

Submit Download

uLekaxYr[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R7K7Z5DQ\uLekaxYr[1].txt
Size 13B
SHA256 2dfa9df9dacae3dc4f6ac7b8b3c443bd66f29e684f7649fad0046b2af6547fde
MD5 8530569e77a351c51f03d495dcef94f3
SHA1 b4be8ed005959df52a946e2f20ee428cb6d033af
SHA512 363b87a3720e5bffcc64b079a135b1c8b2768a9cd17b42b55ffe149b31521209999aa9183a7539a51f134706102dc5433702c9df2bd1259a001464324bc0c567
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads