534de2e2084c11983e3aceb7e6d272dc73a3f7a60d782aa242ce657525b97b0b

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Requisitos detallados E9988001MX_.js
Size 1.0MB
Sample260820-ryrmxayglg
SHA256 534de2e2084c11983e3aceb7e6d272dc73a3f7a60d782aa242ce657525b97b0b
MD5 d14a040103699cc9df357322f3f31998
SHA1 d940d8dd4f7d3eb4a705c0ab771ed8a922da3861
SHA512 cc830debaf7bd0168656743bb154476c76af6200e753b21cf1decb2315b9ce4043fb2ec6a16e3f5f9c6ad7347eda8ded4c9c9bbd4e75e44420af1e2737d8bd4b
SSDEEP 24576:DGvuKAyTPuN7eUuJ4boOzWA2li8crOKDgZ1Q1Y1BZhrp0GMBHxYeQ8uWtxA/:beUSfHn1ThyUFok
TLSH
T19A35D1947FA030AFE34C9AD5031F539B41F49D822E095487B7BEC786773AA82CC75A49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6044	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6044 set thread context of 3348	6044	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6044	powershell.exe
6044	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6044	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 6044	1488	wscript.exe	92
PID 6044 wrote to memory of 2692	6044	powershell.exe	94
PID 2692 wrote to memory of 4256	2692	csc.exe	95
PID 6044 wrote to memory of 3348	6044	powershell.exe	96
PID 6044 wrote to memory of 3348	6044	powershell.exe	96
PID 6044 wrote to memory of 3348	6044	powershell.exe	96
PID 6044 wrote to memory of 3348	6044	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Requisitos detallados E9988001MX_.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\40egr03h\tmp_42902_9dfc.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vots2cc3\vots2cc3.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C5C.tmp" "c:\Users\Admin\AppData\Local\Temp\vots2cc3\CSCFCF00E2639C04AB1BDB7658FAF67FD6.TMP"
      4⤵
      PID:4256
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3348

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp_42902_9dfc.ps1

Path C:\Users\Admin\AppData\Local\Temp\40egr03h\tmp_42902_9dfc.ps1
Size 381KB
SHA256 3a5067281fcc53b0995d743ff31dfe96bcc22443477d0b4d1c4960232c4a57f5
MD5 9d847a45f47b1a9d1812df266382ae7e
SHA1 e2b4c1f65a51adecbbe641b42f484bb833bc9a8d
SHA512 466fd37e4793403b47b5f029b58f37e825c48054ba8af008a7ee1f821f1ee05302b5b92ab32f757e23b391a9f5bf23a9e20c8165fad3d90b3646d696afd1b9bc
SSDEEP 6144:vRU0pyn8mBaoNXmyFPzqJtVh0YxUsw3acCIpn0QUuEdNyuN+WgW2DkI2BllDWrdB:JUln8gdpqJzm3t3+Ip0Lj7h2ZMlDWBBj
TLSH
T1548423067FBF4EB6136E7944357B1A8E7DB08F46C15890C6F67AB8CD6B0982050532AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6C5C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6C5C.tmp
Size 1KB
SHA256 ca76dfa16e624a6efeadaf5b67601d712e86c2ddf82819f56a20cdfe910e6799
MD5 ca86e504db1b916e8f272a45c3b03e30
SHA1 27b88f20fc76123479fbda49a424cea666557ad2
SHA512 3ce51af2832df9a9fe84898c0f7b889093d2f81f550b12d6de0da855fed1556540eac60ca8fb4c4ff9c6cf57a2597f8e1393dc32be573f6e4486b50b015fff1a
TLSH
T19F21AA0593E84B1BF073873169F6172B9678FE95EFA2A35A854002182C50904EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

vots2cc3.dll

Path C:\Users\Admin\AppData\Local\Temp\vots2cc3\vots2cc3.dll
Size 3KB
SHA256 777c981976c3693f47c9d9dbf52bc51d69a12bba3ed09886647c3c2c082dda3f
MD5 2d4f4b73c120f176f6f404eb90735e79
SHA1 46a5cc745c99a4be33ec5a1beee3ff411b23643b
SHA512 4b61ccfd65c67c431552e8d4865e5fc6c0eedee2c4da33c8447a1a2f58c53b51dd434b3485815031e5052abfd7d2ab4305075c42470f38eae1733e8eb393485e
TLSH
T11351CB1B57E8462BF0730B306EF347267BB4F8549FB3A75E09900258AC606949E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFCF00E2639C04AB1BDB7658FAF67FD6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vots2cc3\CSCFCF00E2639C04AB1BDB7658FAF67FD6.TMP
Size 652B
SHA256 0188d4423a406cc350cc498a09c3b3f809561d70994d55d648169ed100631a2c
MD5 e77c17cb7f66a86ab4cae830216ce6a5
SHA1 17ea3b4902a601bc19be29d3f104da6b63b4e672
SHA512 c5589890ad87b13742ee0a6c5795ca626634852a7043479f9f81a679d8cc8528259127204bcec6f25371ada8e44de76f53213878809710352beb36e59b742c22
TLSH
T1D0F0540A63F8020EF0F38B70BDF543639568BD65DE7293ED1584035D18649109AB1F72
MD5 SHA1 SHA512 TLSH

Submit Download

vots2cc3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vots2cc3\vots2cc3.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

vots2cc3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vots2cc3\vots2cc3.cmdline
Size 369B
SHA256 e14973c02c378a9788c6d9354839b68723c440bb0dd489f451dc3e2fa307f72c
MD5 e96cc22175dd0bbb0439692b67911288
SHA1 2917ddbce9b7ca3cbd865193cc9b7b86b3785ba4
SHA512 e816262ca8322c673d3826f852e181ab521dcf0687b25609e69f20637bd09c5c9bdcd4bb15f0285578870b9ad5338b5d63ceaa9e42ec83446febeb26d0147b29
TLSH
T1A1E0C02A4266CA7F12ED340731A9C4ACC37207433F53BFC450544C0DE097001ABD2742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3348-37-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/6044-18-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-11-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-13-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-14-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-15-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-16-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-17-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-2-0x00007FFCC59FF000-0x00007FFCC5A00000-memory.dmp

Download

memory/6044-19-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-20-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-21-0x000001C0E5C80000-0x000001C0E5C96000-memory.dmp

Download

memory/6044-12-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-10-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-9-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-34-0x000001C0E5C90000-0x000001C0E5C98000-memory.dmp

Download

memory/6044-7-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-5-0x000001C0E5BD0000-0x000001C0E5BF2000-memory.dmp

Download

memory/6044-35-0x000001C0E5CA0000-0x000001C0E5CA8000-memory.dmp

Download

memory/6044-6-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-36-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download

memory/6044-39-0x00007FFCC5870000-0x00007FFCC6214000-memory.dmp

Download