Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/08/2026, 16:50
General
- Target MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js
- Size 1.5MB
- Sample260817-vcchmsem8s
- SHA256 63293659e7617226c9d4420f00ca7ab408507898ec0c98f5a88e99f19c7b7491
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 31 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 15 /tn MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js /tr C:\Users\Admin\Pictures\MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 15 /tn MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js /tr C:\Users\Admin\Pictures\MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$code = 'using System; using System.Runtime.InteropServices; public class WindowManager { [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern bool MoveWindow(IntPtr hWnd, int X, int Y, int nWidth, int nHeight, bool bRepaint); }'; Add-Type -TypeDefinition $code; $processes = Get-Process -Name 'powershell' -ErrorAction SilentlyContinue; foreach ($p in $processes) { if ($p.MainWindowHandle -ne 0) { [WindowManager]::ShowWindow($p.MainWindowHandle, 0); [WindowManager]::MoveWindow($p.MainWindowHandle, -32000, -32000, 0, 0, $true); } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jj2dfmsr\jj2dfmsr.cmdline"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$code = 'using System; using System.Runtime.InteropServices; public class WindowManager { [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern bool MoveWindow(IntPtr hWnd, int X, int Y, int nWidth, int nHeight, bool bRepaint); }'; Add-Type -TypeDefinition $code; $processes = Get-Process -Name 'powershell' -ErrorAction SilentlyContinue; foreach ($p in $processes) { if ($p.MainWindowHandle -ne 0) { [WindowManager]::ShowWindow($p.MainWindowHandle, 0); [WindowManager]::MoveWindow($p.MainWindowHandle, -32000, -32000, 0, 0, $true); } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2tkvb0ov\2tkvb0ov.cmdline"3⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Pictures\MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 15 /tn MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js /tr C:\Users\Admin\Pictures\MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 15 /tn MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js /tr C:\Users\Admin\Pictures\MV_SSL_BRAHMAPUTRA_FULL_VESSEL_INFORMATION_PDF.js3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$code = 'using System; using System.Runtime.InteropServices; public class WindowManager { [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern bool MoveWindow(IntPtr hWnd, int X, int Y, int nWidth, int nHeight, bool bRepaint); }'; Add-Type -TypeDefinition $code; $processes = Get-Process -Name 'powershell' -ErrorAction SilentlyContinue; foreach ($p in $processes) { if ($p.MainWindowHandle -ne 0) { [WindowManager]::ShowWindow($p.MainWindowHandle, 0); [WindowManager]::MoveWindow($p.MainWindowHandle, -32000, -32000, 0, 0, $true); } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\amz4pfwb\amz4pfwb.cmdline"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$code = 'using System; using System.Runtime.InteropServices; public class WindowManager { [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern bool MoveWindow(IntPtr hWnd, int X, int Y, int nWidth, int nHeight, bool bRepaint); }'; Add-Type -TypeDefinition $code; $processes = Get-Process -Name 'powershell' -ErrorAction SilentlyContinue; foreach ($p in $processes) { if ($p.MainWindowHandle -ne 0) { [WindowManager]::ShowWindow($p.MainWindowHandle, 0); [WindowManager]::MoveWindow($p.MainWindowHandle, -32000, -32000, 0, 0, $true); } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hxt1yyrt\hxt1yyrt.cmdline"3⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
World_cup.mp3
__PSScriptPolicyTest_lnxtncmp.hgq.ps1
2tkvb0ov.0.cs
2tkvb0ov.cmdline
amz4pfwb.cmdline
hxt1yyrt.cmdline
jj2dfmsr.cmdline
memory/352-31-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/352-82-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/352-34-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/352-27-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/352-30-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/352-29-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/352-28-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/352-25-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/352-26-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/352-8-0x000001C474720000-0x000001C474742000-memory.dmp
memory/692-74-0x0000000006DD0000-0x0000000006E73000-memory.dmp
memory/692-19-0x0000000004D00000-0x0000000004D66000-memory.dmp
memory/692-24-0x0000000005480000-0x00000000057DB000-memory.dmp
memory/692-91-0x00000000078C0000-0x000000000790E000-memory.dmp
memory/692-18-0x0000000004C60000-0x0000000004C82000-memory.dmp
memory/692-20-0x0000000005410000-0x0000000005476000-memory.dmp
memory/692-89-0x0000000007E30000-0x00000000083EA000-memory.dmp
memory/692-32-0x0000000005940000-0x000000000595E000-memory.dmp
memory/692-33-0x0000000005AA0000-0x0000000005AEC000-memory.dmp
memory/692-75-0x0000000006ED0000-0x0000000006EDA000-memory.dmp
memory/692-88-0x0000000007080000-0x00000000070A2000-memory.dmp
memory/692-36-0x0000000006020000-0x000000000603A000-memory.dmp
memory/692-35-0x00000000070B0000-0x000000000772C000-memory.dmp
memory/692-86-0x0000000007030000-0x0000000007041000-memory.dmp
memory/692-76-0x00000000077D0000-0x0000000007866000-memory.dmp
memory/692-12-0x0000000004DC0000-0x000000000540A000-memory.dmp
memory/692-11-0x0000000002560000-0x0000000002596000-memory.dmp
memory/692-69-0x0000000070BD0000-0x0000000070C1C000-memory.dmp
memory/692-72-0x0000000006DB0000-0x0000000006DD0000-memory.dmp
memory/692-68-0x0000000006D50000-0x0000000006D86000-memory.dmp
memory/1088-16-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/1088-15-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/1088-13-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/1088-10-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/1088-9-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/1088-5-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/1088-85-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/1088-1-0x00007FFDCD20F000-0x00007FFDCD210000-memory.dmp
memory/1088-14-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/1088-17-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/1088-23-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/1088-2-0x00007FFDCD080000-0x00007FFDCDA24000-memory.dmp
memory/4456-96-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4456-92-0x0000000070BD0000-0x0000000070C1C000-memory.dmp