Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 10:16
General
- Target Documento di preventivo_ 07.08.2026 xls.js
- Size 1.3MB
- Sample260807-ma8jaswsfx
- SHA256 d697ffce28c39d6553ac42bd90b640a5de08a251ef612c7ce8fc35f0866afaae
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Documento di preventivo_ 07.08.2026 xls.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\6erbh30gijtq.cmd"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:EQYNHWWHJAD))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\6erbh30gijtq.cmd" UNVBJLHCO"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:PESCGEKYOHX))"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\fontcache_v\fontcache_v.dat"5⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:SDOPLCYRUG))"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\whoami.exe"C:\Windows\system32\whoami.exe" /groups6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 27206⤵
- Program crash
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4584 -ip 45841⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
6erbh30gijtq.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_aojig4oi.gg2.ps1
memory/4584-37-0x0000000071380000-0x00000000713CC000-memory.dmp
memory/4584-42-0x00000000074E0000-0x0000000007583000-memory.dmp
memory/4584-38-0x0000000071500000-0x000000007185B000-memory.dmp
memory/4584-41-0x00000000074B0000-0x00000000074D0000-memory.dmp
memory/4584-43-0x00000000075E0000-0x00000000075EA000-memory.dmp
memory/4584-44-0x0000000007620000-0x000000000764A000-memory.dmp
memory/4584-36-0x0000000007270000-0x00000000072A6000-memory.dmp
memory/4584-35-0x0000000008300000-0x00000000088BA000-memory.dmp
memory/4584-34-0x00000000071D0000-0x00000000071F2000-memory.dmp
memory/4584-33-0x0000000007130000-0x00000000071C6000-memory.dmp
memory/4584-45-0x0000000007650000-0x0000000007674000-memory.dmp
memory/4584-31-0x0000000005990000-0x0000000005CEB000-memory.dmp
memory/4584-46-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4672-13-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/4672-14-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/4672-2-0x00007FFB91F7F000-0x00007FFB91F80000-memory.dmp
memory/4672-5-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/4672-6-0x000002AFF90A0000-0x000002AFF90C2000-memory.dmp
memory/4672-7-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/4672-8-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/4672-9-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/4672-10-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/4672-11-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/6064-22-0x0000000005B30000-0x0000000005E8B000-memory.dmp
memory/6064-15-0x0000000002BE0000-0x0000000002C16000-memory.dmp
memory/6064-16-0x0000000005470000-0x0000000005ABA000-memory.dmp
memory/6064-17-0x0000000005220000-0x0000000005242000-memory.dmp
memory/6064-19-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/6064-18-0x00000000053C0000-0x0000000005426000-memory.dmp
memory/6064-24-0x0000000006000000-0x000000000601E000-memory.dmp
memory/6064-27-0x00000000065A0000-0x00000000065BA000-memory.dmp
memory/6064-26-0x0000000007880000-0x0000000007EFC000-memory.dmp
memory/6064-25-0x00000000061F0000-0x000000000623C000-memory.dmp