9aaf4d1ea9204c90e22d3d4320ad22d958986ba531f8beeff2c94929ae500996

Analysis

max time kernel
298s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LPO3002.2026_FLOW MOTION_48813.20AED.js
Size 481KB
Sample260823-bd6cka1fnc
SHA256 9aaf4d1ea9204c90e22d3d4320ad22d958986ba531f8beeff2c94929ae500996
MD5 bad1b7f6d6502d3f0cb49ead021d299a
SHA1 ff571674afaefb938a22539470e131360b36a3d7
SHA512 d5e5b8f6554715129e5b56d22ddf9d189618ab3a9997efbafcff0d306ca28340f06a2a64ed6a8e59dd0f0fb627fc538cdeca1617b38fe4084b0283513c282606
SSDEEP 6144:Ep9OfC8szVkmAjTnId7c5EwSCGVVXDOXHsgsY+MdT0tfAs5NTTtEoNf:EpgfCT0jrId7c52CGVVzOXsVKefAIFB
TLSH
T1B3A4762E453AE5191C50D8F0D6C1B491722DCFAF7F5E0D475B4E88FCAA8612A0067AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4240 created 904	4240	powershell.exe	81

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4240	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4240	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4240	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4240	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6124	conhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 4844	6124	conhost.exe	93
PID 3028 wrote to memory of 4240	3028	conhost.exe	95
PID 4240 wrote to memory of 2600	4240	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:904
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\LPO3002.2026_FLOW MOTION_48813.20AED.js"
  2⤵
  PID:4324
- C:\Windows\System32\smartscreen.exe
  "C:\Windows\System32\smartscreen.exe"
  2⤵
  PID:2600

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2372

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:4844

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\1mv2mt53rt4m\1mv2mt53rt4m.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\1mv2mt53rt4m\1mv2mt53rt4m.ps1
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1mv2mt53rt4m.ps1

Path C:\Users\Admin\AppData\Local\Temp\1mv2mt53rt4m\1mv2mt53rt4m.ps1
Size 1KB
SHA256 36da6ae652935d909452d61c83d61ba2e04a98e2ba1e994aefcb82a2e30e5701
MD5 ff24024011e938af1075fca7d0cc26f3
SHA1 464d18ca7c5fd7bb9da284888a9ca7f891813adb
SHA512 93b5200febc5e54e8b551c9aa93fc8f094759d607f13516475129feb6088181b621f93e98f317053e8c451356b9a1a12d0480789ce7facd9918938a2a0b179ca
TLSH
T11A31D1200345FA6D4561F233CE723DCAD4B05E0DA7DF2605B79FD09DA04B805DE5A286
MD5 SHA1 SHA512 TLSH

Submit Download

1mv2mt53rt4ma

Path C:\Users\Admin\AppData\Local\Temp\1mv2mt53rt4m\1mv2mt53rt4ma
Size 67KB
SHA256 62c3f6058bba1d68d32f12f5c4bf320fc5f643d5e9048bf3d3edfd936fe6d8c8
MD5 10b54982bec5dace7f37dfbdd0508709
SHA1 48c810ec0e2c1b9b2a9e31d50c2da2e060ed7cdb
SHA512 e47b5703e95fa321e8bce379728580727c89914171d6068ccdf564df4d26428c0776b01029d600eba99a8320e917a1dbf64e2d7fc2644fe905fc7461bfa12e84
SSDEEP 1536:rdWFsjK6sinhA2XLHMIGFcB0gDugmj2HEZGU8yb1JndFK795RmN96xK4:rdQ0DXItZgDuDiHEsR0jnngXUjd4
TLSH
T15F6302AE75350B2BFFE49204138CB963F604FE4242A50DBD7B7A4DDA5293585006FB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1mv2mt53rt4mb

Path C:\Users\Admin\AppData\Local\Temp\1mv2mt53rt4m\1mv2mt53rt4mb
Size 67KB
SHA256 c2ee7517f18028cd3ecda3878c3b409189fc83a992a1fc5a191381e7135f8fcb
MD5 9372ba298b71c184ecdf78956f782047
SHA1 ad933cce57a43da5ad6b2101578ccacddf36559c
SHA512 6c6b4571df0c640e9e0ba927c2fe3070b8ba87d436893b7d325fef55770fdb81ff21aae4c76d04fa57cdb85cb7610242f4dedd87d14add060b15d7d9da3d591f
SSDEEP 1536:wCI7ruthOlzNS06XvTVsH0YOYPbWlNrwQnAbggxYhcQRY:wYOlzNsX7VpY5GrBAcwRQa
TLSH
T19D63022B7B291FD53A7F4C7A1137EF3722310B6FD4B4E56A0759A08D2EA7A204E0C841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4240-3-0x000002644EFE0000-0x000002644F002000-memory.dmp

Download

memory/4240-9-0x0000026467550000-0x00000264675A2000-memory.dmp

Download

memory/4240-10-0x000002644EEB0000-0x000002644EEC2000-memory.dmp

Download