374d8623782127c4a1cde1ca64750a693eeda1187c752455cd9d7cff8bd57039

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lwkd-invoice.js
Size 2.0MB
Sample260822-nbj3rstdlg
SHA256 374d8623782127c4a1cde1ca64750a693eeda1187c752455cd9d7cff8bd57039
MD5 f4669c932294aa2c8303b589bc3a5768
SHA1 dae8996274f651c5d9e11a920120aa26c75b94fb
SHA512 98b7f69be7afd73b6f5e0cf4e1380ca87d0bf51476e8d0a8696d174fb4749aa58ca1c990efd1cad1876a18eabd6e9cd5cb21a93555494c174f999f8ac0682fb0
SSDEEP 6144:mSgkQzOEorIQxWcA12Jt1L0a3KbUxXeatCWyhLd4S3:m9kQztorEcA14tx0a6IReatCWsL/
TLSH
T132A5C63D9E6E937922BFCA20C3852D13A95C333671AF19C911D58E8E096F847B9C784D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 24 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3388	powershell.exe
4	3388	powershell.exe
5	3388	powershell.exe
9	3388	powershell.exe
13	3388	powershell.exe
14	3388	powershell.exe
15	3388	powershell.exe
16	3388	powershell.exe
17	3388	powershell.exe
18	3388	powershell.exe
19	3388	powershell.exe
20	3388	powershell.exe
21	3388	powershell.exe
22	3388	powershell.exe
23	3388	powershell.exe
25	3388	powershell.exe
26	3388	powershell.exe
27	3388	powershell.exe
29	3388	powershell.exe
30	3388	powershell.exe
31	3388	powershell.exe
32	3388	powershell.exe
33	3388	powershell.exe
34	3388	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3388	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3388	powershell.exe
3388	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3388	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4632	2960	wscript.exe	89
PID 4632 wrote to memory of 3388	4632	conhost.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\lwkd-invoice.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\208kmt4a58cq\208kmt4a58cq.ps1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\208kmt4a58cq\208kmt4a58cq.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3388

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

208kmt4a58cq.ps1

Path C:\Users\Admin\AppData\Local\Temp\208kmt4a58cq\208kmt4a58cq.ps1
Size 1KB
SHA256 a9b17c0d8d304986e1f0ece95c3ef34d8ebc755484fe95320b8dccfc41bd74e4
MD5 22dd2ebc414743254dda5e1b350af108
SHA1 b67fe533efc178031903965adf06deac0ffd0f79
SHA512 67d313f7114b304a61e05afe668dbf8efa77d6e066d6a0cae02eba806f934489db6e3344f3a95b66c5dd5360df0f7af026dd098ef1ea61e5560a599b37313c08
TLSH
T1593122214BCAEEE90050C03BDDA3C49DC0349D4D6F4DBB1DFB55C958768EA87DE89286
MD5 SHA1 SHA512 TLSH

Submit Download

208kmt4a58cqa

Path C:\Users\Admin\AppData\Local\Temp\208kmt4a58cq\208kmt4a58cqa
Size 66KB
SHA256 5fa1ea1181f2ed679aaef90f5c1d9d1f0aeb723d6af8c6409a19e9a167c4a1ad
MD5 79c97b20977b42c62d63f4482f450279
SHA1 d67d69a551cd55ebc5b46fbe99f3326534c1982e
SHA512 7080968a9df13e1a812c3339b23fa636ac21a73c38d2d43d82ac7fa3d1e2cd41482fccc2f68d98fb5fba9b846256292e6b22933323a05a7249d5ed7633b15754
SSDEEP 1536:Wg+dtb/VS7vsN0DWmhSTHQxxd8U0v/93aJsNTt3VsTX7HWWo6CJLYMNTU31wL:VqRV2IuMHQo9j9MHWWqZTKo
TLSH
T131630240B11CDCEABFD038B2547D155E0ABA2A34351AA7EF3481BBA9140B6739FB751C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

208kmt4a58cqb

Path C:\Users\Admin\AppData\Local\Temp\208kmt4a58cq\208kmt4a58cqb
Size 66KB
SHA256 a01694d399e1ee904a25528896c52c4d80037fb57e3cbcd99f473862f5801a99
MD5 c675d9c4a35a6dd91aca139e8b4bbf96
SHA1 36ed3362d64c72ad0a32a7ad805b48cc9bf8d668
SHA512 a986a38a387b456d29231cc105cd746fcdef87a99d4948a6c46db6b5b32a1f5a0593ddceaaaee80b36899c79b1f96b23db26935f21ba48a0a4eb8c728a135bab
SSDEEP 1536:co8BCywNI97SvEWV2QRfdAWvA0o6foGvRPbgcN:coYCywN1JV2QddDAkfTpTgcN
TLSH
T19F63024C98DAA76027E54C5BF7F7396BFB8182C7DACDF0918580606372467C8B8C5874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3388-10-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-17-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-3-0x00007FF964A4F000-0x00007FF964A50000-memory.dmp

Download

memory/3388-11-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-7-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-12-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-8-0x000001E9EA250000-0x000001E9EA272000-memory.dmp

Download

memory/3388-4-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-16-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-9-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-18-0x000001E9EA3F0000-0x000001E9EA442000-memory.dmp

Download

memory/3388-19-0x000001E9EA240000-0x000001E9EA252000-memory.dmp

Download

memory/3388-20-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-21-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-22-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-24-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-25-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/3388-26-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download