e36016bb9cd242865f3ccda92b764526f6c5a8ca1494dfbe98ecce35c8e181d2

Analysis

max time kernel
149s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 4500107199_2.js
Size 9.3MB
Sample260820-r1fnesdr4x
SHA256 e36016bb9cd242865f3ccda92b764526f6c5a8ca1494dfbe98ecce35c8e181d2
MD5 53852358bf0c0097021a185990825ac9
SHA1 fd79e298a84e91815bff5ee56aae1a8c9a11682c
SHA512 9b9b0237b62ddb19b0925ef8f4866a1b73f7813accf7d46e93eeed759616178781f096e3483a8c660234f8ef971e9f31f69bf3aa660a54c9159a7fdc8969ab7e
SSDEEP 24576:gU4Y19laat47RP89QBGwusuBhmE6HYCY6GObo174UIREbax6ei3HToCLK5q12KPd:EUsWg7r4UsWg7rH
TLSH
T105A6F9B376CE6691AA1D77A7C48C69198786C4218D93B5C490CF0E4E5C2F58F26E0FCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4176	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUpdate_ps_I8MjpkQjMJdS_1787236770422.lnk	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_ps_I8MjpkQjMJdS_1787236770422 = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Temp\\ps_I8MjpkQjMJdS_1787236770422.ps1\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_ps_I8MjpkQjMJdS_1787236770422 = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Temp\\ps_I8MjpkQjMJdS_1787236770422.ps1\""	wscript.exe

ConfuserEx .NET packer 3 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/4176-31-0x000001F00E980000-0x000001F00E994000-memory.dmp	ConfuserEx
behavioral2/memory/4176-38-0x000001F00E6A0000-0x000001F00E6B4000-memory.dmp	ConfuserEx
behavioral2/memory/4176-47-0x000001F00E700000-0x000001F00E714000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 4176 set thread context of 1524	4176	powershell.exe	94
PID 4176 set thread context of 4200	4176	powershell.exe	99
PID 4176 set thread context of 3156	4176	powershell.exe	103
PID 4176 set thread context of 2652	4176	powershell.exe	107
PID 4176 set thread context of 3452	4176	powershell.exe	112
PID 4176 set thread context of 2552	4176	powershell.exe	116
PID 4176 set thread context of 4788	4176	powershell.exe	120
PID 4176 set thread context of 4408	4176	powershell.exe	124

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
3600	1524	WerFault.exe	94
4956	4200	WerFault.exe	99
4528	3156	WerFault.exe	103
4160	2652	WerFault.exe	107
5564	3452	WerFault.exe	112
4344	2552	WerFault.exe	116
3876	4788	WerFault.exe	120
3904	4408	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4176	powershell.exe
4176	powershell.exe
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 4176	2848	wscript.exe	89
PID 4176 wrote to memory of 1524	4176	powershell.exe	94
PID 4176 wrote to memory of 1524	4176	powershell.exe	94
PID 4176 wrote to memory of 1524	4176	powershell.exe	94
PID 4176 wrote to memory of 1524	4176	powershell.exe	94
PID 4176 wrote to memory of 1524	4176	powershell.exe	94
PID 4176 wrote to memory of 4200	4176	powershell.exe	99
PID 4176 wrote to memory of 4200	4176	powershell.exe	99
PID 4176 wrote to memory of 4200	4176	powershell.exe	99
PID 4176 wrote to memory of 4200	4176	powershell.exe	99
PID 4176 wrote to memory of 4200	4176	powershell.exe	99
PID 4176 wrote to memory of 3156	4176	powershell.exe	103
PID 4176 wrote to memory of 3156	4176	powershell.exe	103
PID 4176 wrote to memory of 3156	4176	powershell.exe	103
PID 4176 wrote to memory of 3156	4176	powershell.exe	103
PID 4176 wrote to memory of 3156	4176	powershell.exe	103
PID 4176 wrote to memory of 2652	4176	powershell.exe	107
PID 4176 wrote to memory of 2652	4176	powershell.exe	107
PID 4176 wrote to memory of 2652	4176	powershell.exe	107
PID 4176 wrote to memory of 2652	4176	powershell.exe	107
PID 4176 wrote to memory of 2652	4176	powershell.exe	107
PID 4176 wrote to memory of 3452	4176	powershell.exe	112
PID 4176 wrote to memory of 3452	4176	powershell.exe	112
PID 4176 wrote to memory of 3452	4176	powershell.exe	112
PID 4176 wrote to memory of 3452	4176	powershell.exe	112
PID 4176 wrote to memory of 3452	4176	powershell.exe	112
PID 4176 wrote to memory of 2552	4176	powershell.exe	116
PID 4176 wrote to memory of 2552	4176	powershell.exe	116
PID 4176 wrote to memory of 2552	4176	powershell.exe	116
PID 4176 wrote to memory of 2552	4176	powershell.exe	116
PID 4176 wrote to memory of 2552	4176	powershell.exe	116
PID 4176 wrote to memory of 4788	4176	powershell.exe	120
PID 4176 wrote to memory of 4788	4176	powershell.exe	120
PID 4176 wrote to memory of 4788	4176	powershell.exe	120
PID 4176 wrote to memory of 4788	4176	powershell.exe	120
PID 4176 wrote to memory of 4788	4176	powershell.exe	120
PID 4176 wrote to memory of 4408	4176	powershell.exe	124
PID 4176 wrote to memory of 4408	4176	powershell.exe	124
PID 4176 wrote to memory of 4408	4176	powershell.exe	124
PID 4176 wrote to memory of 4408	4176	powershell.exe	124
PID 4176 wrote to memory of 4408	4176	powershell.exe	124

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO 4500107199_2.js"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo -File "C:\Temp\ps_I8MjpkQjMJdS_1787236770422.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 892
      4⤵
      Program crash
      PID:3600
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 892
      4⤵
      Program crash
      PID:4956
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 892
      4⤵
      Program crash
      PID:4528
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 892
      4⤵
      Program crash
      PID:4160
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 892
      4⤵
      Program crash
      PID:5564
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 892
      4⤵
      Program crash
      PID:4344
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 892
      4⤵
      Program crash
      PID:3876
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 892
      4⤵
      Program crash
      PID:3904

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1524 -ip 1524
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4200 -ip 4200
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3156 -ip 3156
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2652 -ip 2652
1⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3452 -ip 3452
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2552 -ip 2552
1⤵
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4788 -ip 4788
1⤵
PID:5440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4408 -ip 4408
1⤵
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_I8MjpkQjMJdS_1787236770422.ps1

Path C:\Temp\ps_I8MjpkQjMJdS_1787236770422.ps1
Size 3.4MB
SHA256 9a58efb381a0e2eefa3fe6a1126a6185fe3d95a338edd130ff4557e1f65f40ce
MD5 c2f76c9dd53a74d0cbb10b0dd4cead9b
SHA1 b7a55a9935b38e64b37038d11b67ef4865455beb
SHA512 e065f9ffd364056119981250f0d6497cab43167aa3734579d62b2f88e33321944c48e4cd8603608e74ece5aceb47aca08ab150701ee22a5ed314ee6b7c9302a2
SSDEEP 24576:vvFPW3UCDzmTlgnvEdCdnK/5ThNznC0RzcjKgsbxnAHo6:8
TLSH
T181F5A231E44458A973E341D7FA9E0B2B31AC5CE426BBDDA8E458678B032B3B575D4833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-34-0x0000000010000000-0x0000000010014000-memory.dmp

Download

memory/4176-33-0x000001F026E50000-0x000001F026E56000-memory.dmp

Download

memory/4176-6-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-9-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-10-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-11-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-12-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-13-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-14-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-15-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-16-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-17-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-18-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-19-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-22-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-52-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-47-0x000001F00E700000-0x000001F00E714000-memory.dmp

Download

memory/4176-7-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-45-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-42-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-5-0x000001F026DE0000-0x000001F026E02000-memory.dmp

Download

memory/4176-38-0x000001F00E6A0000-0x000001F00E6B4000-memory.dmp

Download

memory/4176-36-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4176-2-0x00007FFA5103F000-0x00007FFA51040000-memory.dmp

Download

memory/4176-31-0x000001F00E980000-0x000001F00E994000-memory.dmp

Download

memory/4456-32-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4456-25-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4456-35-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4456-30-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4456-29-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4456-28-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4456-27-0x00000242B11E0000-0x00000242B1228000-memory.dmp

Download

memory/4456-44-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4456-26-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4456-24-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download

memory/4456-23-0x00007FFA50EB0000-0x00007FFA51854000-memory.dmp

Download