4984941787bd14a6d9a7122ce5a3c69efc3a516ebf651b42e197c3aed8592386

Analysis

max time kernel
300s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO_400269712_Signed_Copy.js
Size 458KB
Sample260813-elsyzsztbx
SHA256 4984941787bd14a6d9a7122ce5a3c69efc3a516ebf651b42e197c3aed8592386
MD5 0996d5efb5569e436f32480fff63a7b7
SHA1 57632c6dfdf5646ddc0b56af25e304d21dd9fe92
SHA512 ff50b755c3ec83b1db512d9299ba72151758a182f8526e13509b72eb20d9d8120114145390ff8844384e5cc121bd17e4db7303bd59c3ddaeb04f8ceb173c05be
SSDEEP 3072:t4hzx/64R9fPZQ59lmAi6gWD5UCIhtpkecrpZT6zN3gEW4SSjjWGBoCEvPxTB+md:eZlnJ61zI8pZOx3gEhfBJeyoZfb8ixZV
TLSH
T154A4CB3D194728686025B012FE867266916FAFDFAF7F3D06519FC2DC03A1D269843DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2044	powershell.exe
7	2044	powershell.exe
9	2044	powershell.exe
10	2044	powershell.exe
11	2044	powershell.exe
12	2044	powershell.exe
14	2044	powershell.exe
15	2044	powershell.exe
16	2044	powershell.exe
17	2044	powershell.exe
18	2044	powershell.exe
19	2044	powershell.exe
20	2044	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2044	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	2044	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4884	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4884	2420	wscript.exe	91
PID 4884 wrote to memory of 2044	4884	wscript.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO_400269712_Signed_Copy.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\r1ymsqzs31j\r1ymsqzs31j.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\r1ymsqzs31j\r1ymsqzs31j.ps1"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2044

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

r1ymsqzs31j.ps1

Path C:\Users\Admin\AppData\Local\Temp\r1ymsqzs31j\r1ymsqzs31j.ps1
Size 1KB
SHA256 f21edb86f28deb38066c59177f0575c1348da2c30a15d724e4859010eb6e6a28
MD5 a2f5e023261df8db55c9d40a9046dbe7
SHA1 4a36977c5483213bde88a14199745a3c1ea6ef10
SHA512 ffd1d743513b5b91b35261ee3349dd7782539018d01fa7d185fb19550c7d773c134df04f4147a41cff096d2655eccbe92a8c8e56a98f9d906c9c4de5f66db1dd
TLSH
T1B33110202783DE7A2786C1338AE5A2DF91341D0C66D63F56B669C8C8235A19197C8BCF
MD5 SHA1 SHA512 TLSH

Submit Download

r1ymsqzs31j.vbs

Path C:\Users\Admin\AppData\Local\Temp\r1ymsqzs31j\r1ymsqzs31j.vbs
Size 228B
SHA256 fd02f82c76b3329ee385629807fc280c32052e80b690e0af5be5ce1d75db79f8
MD5 bc26fac6e8d9afbcbdb69399d760b231
SHA1 903cf7806c7e711d6dbd1ee847e318294965927f
SHA512 3712bbf88186586155ba1515722f2184e870a782ca2c860b812380b595bfe84f75081d85e35ae46a965195ef4636f7ab0d1fe67124224a63976b651f03eb6536
TLSH
T14DD02300763BD30CDD26C43B0072923C80D3AC5C21401F223350941CF596178CF5958E
MD5 SHA1 SHA512 TLSH

Submit Download

r1ymsqzs31ja

Path C:\Users\Admin\AppData\Local\Temp\r1ymsqzs31j\r1ymsqzs31ja
Size 64KB
SHA256 487fe56c9406dae08448242de8023efa17bd98cc0d32e18a999a797b5d2579a9
MD5 e9162edb3792f3470fda9c3a0c5bcf0a
SHA1 a2e7afde84de1df7aa2b9b8e8d9e351bb568ac67
SHA512 a77355f4f716cbbe3f6b9888383cc17b2ec16f681fa9052608c41ea326f10b819b76c3a923d5a1163bfb3a76db44542fede69bab8ba4a2f98a5a8297f6a98b0a
SSDEEP 1536:jkyirWZBJWSVEnlxdAuyTLPR1/REhHbGVUM8iSJQ5i2sT4mlgXmvX:jkJWZBYSGlbAuuLPR1JE5bGVUMXuQY20
TLSH
T16F53029F8EBCDFCE00A4D6A46C99AFC4A6F848475B5A6084F58F742604ECFB5CC1209D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r1ymsqzs31jb

Path C:\Users\Admin\AppData\Local\Temp\r1ymsqzs31j\r1ymsqzs31jb
Size 64KB
SHA256 70e0a3c6654c74489e0675e4a546de21be07be7e24ba2a58a1e192c68b239c30
MD5 0fe3b6ea3da206c44b25f093f7e0c285
SHA1 52a2e7f3977c90572ded1b0f47a5ae1a4309e200
SHA512 b01f42d189d0711b1071e8b65a76f3df7402d3f927209791397d2bd034817270aa145a25361d0e220a715eca013897e386d286decac1803de7865c2afe613ba0
SSDEEP 1536:MlZ8CyeQ3y0erWdA8nUR6xSJ1DyB06OjR0Ukgc6WP0hLTOd:MPx+YWdDURKGyB06OVfkXvP0hXe
TLSH
T12A53028C41D7CCC9620AEE3775C1E89A3E8AADEED2DE45D417036282F0907D26FB2D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2044-8-0x0000011DD28D0000-0x0000011DD28F2000-memory.dmp

Download

memory/2044-12-0x0000011DD2BD0000-0x0000011DD2C1E000-memory.dmp

Download

memory/2044-13-0x0000011DD28C0000-0x0000011DD28D2000-memory.dmp

Download

memory/2044-14-0x0000011DD3440000-0x0000011DD3512000-memory.dmp

Download

memory/2044-15-0x0000011DD3650000-0x0000011DD36CC000-memory.dmp

Download

memory/2044-16-0x0000011DD36D0000-0x0000011DD37A8000-memory.dmp

Download

memory/2044-17-0x0000011DD37B0000-0x0000011DD37FC000-memory.dmp

Download