08f49d4d0068871a08f6ea1a74eb84eeaca586bb8e4cd687c2d8b8f210799041

Analysis

max time kernel
179s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08f49d4d0068871a08f6ea1a74eb84eeaca586bb8e4cd687c2d8b8f210799041.js
Size 2.1MB
Sample260806-qpascssbqa
SHA256 08f49d4d0068871a08f6ea1a74eb84eeaca586bb8e4cd687c2d8b8f210799041
MD5 41a4cba993cf7bd520de232daf7989a8
SHA1 a981d56a77b3ebefdc1068f615ebaaf9563d317a
SHA512 0b010ad884c70f6dd737143f2a7161b9890f16c963fc7ec962b905f0ec2409badcc0cc7c856016003ab6f249f35b69afcb3b38c73de427718155655a7fdd2d64
SSDEEP 3072:l30ug00C030DgK3k0D3y3nuK3RhF30hkubuygu3F0ggF3ugbhggyhygCuDghgFu2:h
TLSH
T1F2A5128345EE76099C133A645B9FAB7EE417DE7E6311C3D324A588C16183CF84A8DEB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	3136	powershell.exe	89

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3856	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3856	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3856	powershell.exe
3856	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\08f49d4d0068871a08f6ea1a74eb84eeaca586bb8e4cd687c2d8b8f210799041.js
1⤵
PID:4380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x00007FFD3432F000-0x00007FFD34330000-memory.dmp

Download

memory/3856-3-0x0000022F551B0000-0x0000022F551D2000-memory.dmp

Download

memory/3856-4-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3856-5-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3856-6-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3856-7-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3856-8-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3856-9-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3856-10-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3856-11-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3856-12-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3856-14-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3856-16-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download