ba32aebc04dc365af12126586dabecfd34c70b3f60103410b6f0086761e3f42e

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER_LIST.js
Size 1004KB
Sample260806-ryfweadl9v
SHA256 ba32aebc04dc365af12126586dabecfd34c70b3f60103410b6f0086761e3f42e
MD5 4623d6173759575088a063ffa5e309a8
SHA1 46013a3d089c3c683692e36cadff8093b2078af0
SHA512 7f1d8c982d700dc2f5ebc36f5348e0f673680ba7f640392bcf8b91a18d15a6db15f5c729bc9e9768cf806d7e05be93ac92ff6667e1a74ec6b4d65c8e177e70a1
SSDEEP 6144:XF3XR9WYdXpKIGu+oQ2qwIh05WqIT0yZ3iEVe8mnBa:Lz2Xbhm8
TLSH
T1CD25EACF6372091C648A7A0FC8386E9E7A9BCF830510FDB9BDA45947C50C74253A5B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3260	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	3260	powershell.exe

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
4748	forfiles.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Environment\UserInitMprLogonScript = "\"C:\\Windows\\system32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\v2043\\v3404.js\""	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3260 set thread context of 1988	3260	powershell.exe	94

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5740	cmd.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3260	powershell.exe
3260	powershell.exe
1988	csc.exe
1988	csc.exe
1988	csc.exe
1988	csc.exe
1988	csc.exe
1988	csc.exe
1988	csc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4748	3124	wscript.exe	88
PID 4748 wrote to memory of 5740	4748	forfiles.exe	91
PID 5740 wrote to memory of 4092	5740	cmd.exe	92
PID 5740 wrote to memory of 3260	5740	cmd.exe	93
PID 3260 wrote to memory of 1988	3260	powershell.exe	94
PID 3260 wrote to memory of 1988	3260	powershell.exe	94
PID 3260 wrote to memory of 1988	3260	powershell.exe	94
PID 3260 wrote to memory of 1988	3260	powershell.exe	94

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ORDER_LIST.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\System32\forfiles.exe
  "C:\Windows\System32\forfiles.exe" /p C:\Windows\System32 /m charmap.exe /c "cmd /v:on /d /c echo !b9w7oEog2H3Pl!|powershell.exe -W h -nOP -NONI -"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\System32\cmd.exe
    /v:on /d /c echo !b9w7oEog2H3Pl!|powershell.exe -W h -nOP -NONI -
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo $iJzp=[powershell]::Create();[void]$iJzp.AddScript([Environment]::GetEnvironmentVariable('ESrXWhMHUt5p','Process'));$iJzp.Invoke()"
      4⤵
      PID:4092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -W h -nOP -NONI -
      4⤵
      Badlisted process makes network request
      Downloads MZ/PE file
      Registers new Windows logon scripts automatically executed at logon.
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3260
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-15-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/1988-14-0x0000000000CA0000-0x0000000000CE6000-memory.dmp

Download

memory/3260-6-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-12-0x000001E5CBAA0000-0x000001E5CBAEE000-memory.dmp

Download

memory/3260-0-0x00007FF964A4F000-0x00007FF964A50000-memory.dmp

Download

memory/3260-8-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-7-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-9-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-10-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-11-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-13-0x000001E5CB9E0000-0x000001E5CB9F2000-memory.dmp

Download

memory/3260-4-0x000001E5CBA00000-0x000001E5CBA22000-memory.dmp

Download

memory/3260-5-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-1-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-18-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-19-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-20-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-22-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3260-23-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download