3e9b5fcc1f49b8b0fe84c9f78b15499ab39e16d8a353f21ef6816c8b82744656

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO139046.js
Size 833KB
Sample260807-ls75tasbkf
SHA256 3e9b5fcc1f49b8b0fe84c9f78b15499ab39e16d8a353f21ef6816c8b82744656
MD5 4cc9e265970754c2c8f49bc839e486b7
SHA1 784b2e4130e2aa524a072620ef40d68dbcc18805
SHA512 ab776345d3d9b85698fd2d18ace7a7595371416cebd09c7224f0d023e5503b56f18d0abbbb61ccf021a293828e0f8c5ac13f358c0ed614e2d9647f8fa6eb9909
SSDEEP 12288:xOrsbfrcrsvioUJcZaLNwsgvcwlFOUqghwBGbY4JH4QrrAZr3Jmvc:sruIvrL/gvXlvqglJJrOZmU
TLSH
T119058CA7D269CF1C8E41B9EB5F5570C3B0DC07CFCAB1C3D4A8A82426B58C859F4AC659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4500	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4308	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4500 set thread context of 4964	4500	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4500	powershell.exe
4500	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 4308	3428	wscript.exe	91
PID 4308 wrote to memory of 4500	4308	wscript.exe	92
PID 4500 wrote to memory of 6064	4500	powershell.exe	94
PID 6064 wrote to memory of 4636	6064	csc.exe	95
PID 4500 wrote to memory of 4964	4500	powershell.exe	96
PID 4500 wrote to memory of 4964	4500	powershell.exe	96
PID 4500 wrote to memory of 4964	4500	powershell.exe	96
PID 4500 wrote to memory of 4964	4500	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO139046.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\khxuonyh\cfg_18817_566c.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\khxuonyh\clr_77019_564c.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qxaxrmz0\qxaxrmz0.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6064
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES695F.tmp" "c:\Users\Admin\AppData\Local\Temp\qxaxrmz0\CSC77D31C22AF82471AB9900D789871D48.TMP"
        5⤵
        
        PID:4636
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      4⤵
      PID:4964

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES695F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES695F.tmp
Size 1KB
SHA256 3ff86d57c0ad4cfd1626c866b765e079d4a553e9a25333c95582b79f4197c5f8
MD5 d3b1fc3f0b313228c57f41f5c6538f8c
SHA1 4ccb7f140ad24d3563b9d03f6b23ce80954ffcca
SHA512 90fe699ac1c91dc58e7d3a33e587ef147697f3baaf9c48a35e4a9689a438b27666037eb18b074b217e299358752f13c1db4ce0b56af3140abaabb549df347ec1
TLSH
T1CA21AA0597ED4B5FF077473169F6132F9274FD64EFA2635A454042282852504EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

cfg_18817_566c.vbs

Path C:\Users\Admin\AppData\Local\Temp\khxuonyh\cfg_18817_566c.vbs
Size 228B
SHA256 9b08ed48629f969dfabeb42909b538c5bb2823cac33fb8cbb2293580c7a002b6
MD5 71b870e28738117f5c6259a961bfd26e
SHA1 43c8e4b077123b22c518087855c6f2a3d8520de3
SHA512 0f0c8d64134e58e3ea2a2409dd788d58e266274e9a2b02627d48d1c963ac25d2eb1fe200a7d546189a9805968971af249252b916edf78ea6c3f30e389f389820
TLSH
T13CD09700623EE21CEC24C4290462822C80E3B868210067202B50D908F9802A9CA5D148
MD5 SHA1 SHA512 TLSH

Submit Download

clr_77019_564c.ps1

Path C:\Users\Admin\AppData\Local\Temp\khxuonyh\clr_77019_564c.ps1
Size 5KB
SHA256 a9aecb8e173c1bdb9a2b70158fd1ae6f5b6f35bceb7d93434c62149e76449e7b
MD5 6e7a8290e2fcaa5420dda859efe20d92
SHA1 adfcd2fabed1ba63cb3c3765f3ccfc7fdac4b60a
SHA512 98e5920bce1fc84a029c9a79a936bec315c7c401ccfad3867cf2713e078aa650c1b4fda9e048027463e7e4e2a1d1390029a369f604e9b4aa026d22ec3e709666
SSDEEP 96:aJcQulO9GG3z5Xayg9GUij/f5m/Tf5BB9GIoBY67tKhwwDzm8CgrcXqHOpoulDVD:gmOEG39XaygEUij/fIfX+IomItKh3mWq
TLSH
T156C1750B7ADE4BFA02C374755DB61541F268D02B264F1C04F6EDC6CAAF06434D7E91A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run_15259_564b

Path C:\Users\Admin\AppData\Local\Temp\khxuonyh\run_15259_564b
Size 328KB
SHA256 1b09b1e67149d5e4508dec29e860b1a789a06a1116bdc40a6d941d5b7b1da0b7
MD5 70e7d8e5de5c1bd6f922167d1a2f008b
SHA1 90521286a64ed2c6b3d7030aecfed7891b294494
SHA512 f917b37f0aaef2413babfc44ce50afa31c9f349971af675fef3bbbed1b806d09399cfa015bd3126c95a464f64f8686cb69839f558df2b05366330e6c7bbecc26
SSDEEP 6144:3z5QmmeRp5cwnF5puH1pEqEnOGKParDWRTw/N0UKiNKDeuIKT5yLxKJ+k:3z5QmmeRp5tDYEqEOrPmKRk/+Sk32YMk
TLSH
T1D564230F8BBE8DC882FD248B30BB0F4F855D459514353BD54A99F9EA580ED2C635B4B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_105140_5649

Path C:\Users\Admin\AppData\Local\Temp\khxuonyh\svc_105140_5649
Size 48KB
SHA256 7b60e948e31a88426a6991efb4cb2415057a0e48ceee1b5ca2d9276aa71a22d9
MD5 b0de36e2a1f037eb08595a7104043d11
SHA1 28ed2699d8ecbf624e4d0fd788f51a426d402046
SHA512 849b1a80cf76e8c3644d13fed07b2c3b8d1a488da72dd49f0b82c71ef82f98d2655f7a06a3fb494623469ef459140ca2f923311f991226a9006b2fa0d86f31b6
SSDEEP 768:0905+BjYkyycMlXL85m7X+o9RMWOTbAnREqqb7ydOkXvBm43d655YsLSLe+z43E7:eBfl7K2uo95OYna/kfg6QwuSLeUBXSC
TLSH
T13E230206C9AF4F6B5338F31FF391BB4365778CBA8E4D6CED52148210662D63927A7290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qxaxrmz0.dll

Path C:\Users\Admin\AppData\Local\Temp\qxaxrmz0\qxaxrmz0.dll
Size 3KB
SHA256 0f3c9122b5ef708a7cba3fd0dc8e2777b9e873ead6569e4aa5989e017cb7be76
MD5 3c1281e1c1f66b6334139187eee58898
SHA1 2b711e72c3afa142faca47feb3c9c84691ebcbf6
SHA512 80872efd2afb5375d98c898fa31fb775f43eefb9e01f38e0db55ec405aca7174e17f2c4458ca36729214aac90631ccfe39e570b89eeb05d5757ee682745b566a
TLSH
T17D51DD1B9BE88A2BF4770B305DF3431777A4F8109BB2971E1D905218AC616549A31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC77D31C22AF82471AB9900D789871D48.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qxaxrmz0\CSC77D31C22AF82471AB9900D789871D48.TMP
Size 652B
SHA256 c559d5cfbad6ec00e4584a9b81e35f3f8549b4a777f4718fb939d68d9a97ac38
MD5 143933c8b5f20943e71b9c63e0810119
SHA1 851c415f76bfdb72ab552f296139d695a6ae58be
SHA512 5ecd4e2bb94fc530eb2b74ceffd3a6fbed4658b67dd299dd5f66cf59a908885a1b98e3ca0d618508989544ea2eeef221fe4614d8d8c6e2f267ccccd67acb70bb
TLSH
T163F05E1A67F8420EF0F75B30BDF6436795A8BD64DE3293ED2440031928659148A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qxaxrmz0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qxaxrmz0\qxaxrmz0.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

qxaxrmz0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qxaxrmz0\qxaxrmz0.cmdline
Size 369B
SHA256 ec5e497a66a9b569203090cf52bec90b5b20ea7eec1b1cf8cf6fbdcea7a5ca65
MD5 00a58966fd6122e1ea3cab17a2e4246a
SHA1 9967cd2cbf2466b269b49d18f294aaaab9350807
SHA512 5c4a6d4cb87db5c30fbb9ec702e0791b953635d42ab9f3e5edf6b42a1d6bf30851811de2cc56a9d4a2f806313248291f03985ac2baaa1a2945946de9b7f005e3
TLSH
T1D7E0C02E8A46CA7D06DD1407226DC6ACC27A47D32B807F845070640FF017800B7D1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4500-12-0x000001D44DF90000-0x000001D44DFAA000-memory.dmp

Download

memory/4500-6-0x000001D435DE0000-0x000001D435E02000-memory.dmp

Download

memory/4500-25-0x000001D435900000-0x000001D435908000-memory.dmp

Download

memory/4500-26-0x000001D435E10000-0x000001D435E18000-memory.dmp

Download