4984941787bd14a6d9a7122ce5a3c69efc3a516ebf651b42e197c3aed8592386

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO_400269712_Signed_Copy.js
Size 458KB
Sample260813-npsl3axvbv
SHA256 4984941787bd14a6d9a7122ce5a3c69efc3a516ebf651b42e197c3aed8592386
MD5 0996d5efb5569e436f32480fff63a7b7
SHA1 57632c6dfdf5646ddc0b56af25e304d21dd9fe92
SHA512 ff50b755c3ec83b1db512d9299ba72151758a182f8526e13509b72eb20d9d8120114145390ff8844384e5cc121bd17e4db7303bd59c3ddaeb04f8ceb173c05be
SSDEEP 3072:t4hzx/64R9fPZQ59lmAi6gWD5UCIhtpkecrpZT6zN3gEW4SSjjWGBoCEvPxTB+md:eZlnJ61zI8pZOx3gEhfBJeyoZfb8ixZV
TLSH
T154A4CB3D194728686025B012FE867266916FAFDFAF7F3D06519FC2DC03A1D269843DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2644	powershell.exe
8	2644	powershell.exe
10	2644	powershell.exe
12	2644	powershell.exe
14	2644	powershell.exe
16	2644	powershell.exe
17	2644	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2644	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	2644	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1828	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2644	powershell.exe
2644	powershell.exe
2644	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 1828	4204	wscript.exe	91
PID 1828 wrote to memory of 2644	1828	wscript.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO_400269712_Signed_Copy.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\1uxumsrfy4f4\1uxumsrfy4f4.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\1uxumsrfy4f4\1uxumsrfy4f4.ps1"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2644

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1uxumsrfy4f4.ps1

Path C:\Users\Admin\AppData\Local\Temp\1uxumsrfy4f4\1uxumsrfy4f4.ps1
Size 1KB
SHA256 75b58cfa6cde471500904468746c7db224c16d7519c4378bbe89b60c76c4b098
MD5 8a9f0d25e5d5a27025f61f4db04c7929
SHA1 5bf58517e73560b45e5a7bd1f6013fc35b314eee
SHA512 8964e25aaaeebfd6be5fd538218dadeb874335d5c5947a2d468cc1498e5dcc2f7b39e5d8da638d19c1b4ca132508e4c39e1e9102359969efd945efa78bdafcdd
TLSH
T1633122210683E9BB16C5B1338AD2A2DFA130090C27C63BA5FB79DA44334629157DCB4B
MD5 SHA1 SHA512 TLSH

Submit Download

1uxumsrfy4f4.vbs

Path C:\Users\Admin\AppData\Local\Temp\1uxumsrfy4f4\1uxumsrfy4f4.vbs
Size 230B
SHA256 9cf488fefa12bbe4a0ac860cee61bf30e47ecae21e24332406dde2fc24a5815a
MD5 f571f86841cf1ae428cd89dcdd40b7d8
SHA1 99d789dcc152f5129d7f1c91a6eaf7d15af341d2
SHA512 b9d812988519fb742784a068821e914d09b51f9ad3a1ff25d80123ef8a447e4577e62260ab5052493a415709d53c85d941a3e80f06c140380e325976c13c5485
TLSH
T191D023226539F35ECCA4D43501F3923C84D3545C214017306B70E604FF82378CF6E50A
MD5 SHA1 SHA512 TLSH

Submit Download

1uxumsrfy4f4a

Path C:\Users\Admin\AppData\Local\Temp\1uxumsrfy4f4\1uxumsrfy4f4a
Size 64KB
SHA256 487fe56c9406dae08448242de8023efa17bd98cc0d32e18a999a797b5d2579a9
MD5 e9162edb3792f3470fda9c3a0c5bcf0a
SHA1 a2e7afde84de1df7aa2b9b8e8d9e351bb568ac67
SHA512 a77355f4f716cbbe3f6b9888383cc17b2ec16f681fa9052608c41ea326f10b819b76c3a923d5a1163bfb3a76db44542fede69bab8ba4a2f98a5a8297f6a98b0a
SSDEEP 1536:jkyirWZBJWSVEnlxdAuyTLPR1/REhHbGVUM8iSJQ5i2sT4mlgXmvX:jkJWZBYSGlbAuuLPR1JE5bGVUMXuQY20
TLSH
T16F53029F8EBCDFCE00A4D6A46C99AFC4A6F848475B5A6084F58F742604ECFB5CC1209D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1uxumsrfy4f4b

Path C:\Users\Admin\AppData\Local\Temp\1uxumsrfy4f4\1uxumsrfy4f4b
Size 64KB
SHA256 70e0a3c6654c74489e0675e4a546de21be07be7e24ba2a58a1e192c68b239c30
MD5 0fe3b6ea3da206c44b25f093f7e0c285
SHA1 52a2e7f3977c90572ded1b0f47a5ae1a4309e200
SHA512 b01f42d189d0711b1071e8b65a76f3df7402d3f927209791397d2bd034817270aa145a25361d0e220a715eca013897e386d286decac1803de7865c2afe613ba0
SSDEEP 1536:MlZ8CyeQ3y0erWdA8nUR6xSJ1DyB06OjR0Ukgc6WP0hLTOd:MPx+YWdDURKGyB06OVfkXvP0hXe
TLSH
T12A53028C41D7CCC9620AEE3775C1E89A3E8AADEED2DE45D417036282F0907D26FB2D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2644-6-0x000001FEF9010000-0x000001FEF9032000-memory.dmp

Download

memory/2644-12-0x000001FEF92E0000-0x000001FEF932E000-memory.dmp

Download

memory/2644-13-0x000001FEF9080000-0x000001FEF9092000-memory.dmp

Download

memory/2644-14-0x000001FEF9B50000-0x000001FEF9C22000-memory.dmp

Download

memory/2644-15-0x000001FEF9D60000-0x000001FEF9DDC000-memory.dmp

Download

memory/2644-16-0x000001FEF9DE0000-0x000001FEF9EB8000-memory.dmp

Download

memory/2644-17-0x000001FEF9EC0000-0x000001FEF9F0C000-memory.dmp

Download