Analysis
- max time kernel
300s - max time network
302s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/08/2026, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
سند پیوست جهت بررسی و امضاpdf.js
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
300 seconds
Behavioral task
behavioral2
Sample
سند پیوست جهت بررسی و امضاpdf.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
300 seconds
General
- Target سند پیوست جهت بررسی و امضاpdf.js
- Size 2.0MB
- Sample260824-k93e8aem2x
- SHA256 346fb6182653bc824067fa2752028a5c6a432d3ee6bcd954070113b95026fa4b
- MD5 a1562e64f7071b58f3690de5b36fda78
- SHA1 4ec507beffa918a9cd05233fe21894c9b73eedc9
- SHA512 bf1181a70943f559c1c558aec4d374bc6f758a4cfd0083131f9c56fc3eb9b0687e79840c9778b7bc59704370d9eb5aebb88a5379b723ca69daa00b5f9c3cd84f
- SSDEEP 6144:8fbtRh8cwoHxi2dDApxDJvJk9yX8JdRtV6WHx1UTyZ:8fbtRhdHg2dDApFJxk9ysJ7tEWR17
- TLSH T11FA5C83EEF8171ABD632C9114BC57013C19BBB43136E489C18DA1F9C0AD628A7ED665F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 2328 powershell.exe 19 2328 powershell.exe 20 2328 powershell.exe 24 2328 powershell.exe 25 2328 powershell.exe 30 2328 powershell.exe 31 2328 powershell.exe 35 2328 powershell.exe 38 2328 powershell.exe 39 2328 powershell.exe 42 2328 powershell.exe 43 2328 powershell.exe 46 2328 powershell.exe 53 2328 powershell.exe 57 2328 powershell.exe 58 2328 powershell.exe 66 2328 powershell.exe 78 2328 powershell.exe 79 2328 powershell.exe 80 2328 powershell.exe 81 2328 powershell.exe 82 2328 powershell.exe 83 2328 powershell.exe 87 2328 powershell.exe 90 2328 powershell.exe 91 2328 powershell.exe 92 2328 powershell.exe 109 2328 powershell.exe 112 2328 powershell.exe 115 2328 powershell.exe 116 2328 powershell.exe 117 2328 powershell.exe 118 2328 powershell.exe 121 2328 powershell.exe 122 2328 powershell.exe 123 2328 powershell.exe 124 2328 powershell.exe 125 2328 powershell.exe 128 2328 powershell.exe 129 2328 powershell.exe 130 2328 powershell.exe 131 2328 powershell.exe 132 2328 powershell.exe 133 2328 powershell.exe 134 2328 powershell.exe 135 2328 powershell.exe 136 2328 powershell.exe 137 2328 powershell.exe 138 2328 powershell.exe 139 2328 powershell.exe 141 2328 powershell.exe 142 2328 powershell.exe 143 2328 powershell.exe 144 2328 powershell.exe 145 2328 powershell.exe 146 2328 powershell.exe 147 2328 powershell.exe 153 2328 powershell.exe 154 2328 powershell.exe 155 2328 powershell.exe 157 2328 powershell.exe 158 2328 powershell.exe 159 2328 powershell.exe 160 2328 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2328 powershell.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation wscript.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2328 powershell.exe 2328 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2328 powershell.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4864 wrote to memory of 4772 4864 wscript.exe 84 PID 4772 wrote to memory of 2328 4772 conhost.exe 85 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\سند پیوست جهت بررسی و امضاpdf.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\1r7hmt70xq6h\1r7hmt70xq6h.ps1"2⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\1r7hmt70xq6h\1r7hmt70xq6h.ps13⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵PID:4560
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\1r7hmt70xq6h\1r7hmt70xq6h.ps1
- Size 1KB
- SHA256 d639d3ccbf9f45c263aebd143b57770af23d8db5394d3089e76cfb036ca1b9b6
- MD5 4ccf7b7a2dd9467fc440d63a110e712f
- SHA1 9fb697d39556f7f537b872d94473ce0c26e7d4f6
- SHA512 4745f95b385694b7472d13eab26b644fd9f3852d088ed088c42ea8be1ed4795a7094c9bb3791cd6363a11fe6a93aece796093c26d0eb17640bcda8dc64414d78
- TLSH T1FA31222623CB9B392646A063EFD28D5F99357C09F28EE786F3CDC04851C14C566D5387
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1r7hmt70xq6h\1r7hmt70xq6ha
- Size 63KB
- SHA256 4dcc57372a3e0dbc85af8edd9bd5ea0597ea93ff450a3a9a4c09127d643320a5
- MD5 70f53849b5aa70a7e8ec84a851765c77
- SHA1 a4aa9efddb4cc15322e4b651fa00200e252b3430
- SHA512 26ede00381f0217bb60683fa391f358cb729d6173b524efa55479ae83b7edd8b3567a724877ecf28145afadfebbbb744e23ee9337c929615a0f47125b2452481
- SSDEEP 768:mhs58prBhQ9T9ZzQ1C05ycaKCYi0aTIbHmyBUBTbjBb1YU8VDkf2ljdxGII5Gbll:DU43eCya70fhUB3jJKUGkIGfE
- TLSH T11C53028A3A7F8CB43BDCCA1898264DF7D5C9DCC58818AE61B3D539E0569CB12CCD3949
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1r7hmt70xq6h\1r7hmt70xq6hb
- Size 63KB
- SHA256 876db2b1d8b967d583836a46388b9fcde7c723e1d4b541ec5b8c4d0542d6abf2
- MD5 fdb3df30c79c08bb61a9ba3170972394
- SHA1 ebb6417db95219c183687b92c42ddeb739843869
- SHA512 90a050faf444006e02c7dd81484974dbcda3ac3b8c8add310aafbb75e47ec53c7a5fc065603248756e8e7ea247a8ff74c6ab79d9aed85c14d8c5d05fc95e966b
- SSDEEP 1536:2eSmPa/1JlCCmtJVPnFuJOA8uWe5ytKgYC40F/jRgvFS4NVhQP:Ra9J1KVvFu98uWeAtjYqjqXmP
- TLSH T1CB531263DBA43F568A59F123CA8C01CF12739C53C34992FB0585DA795783AB0E70969E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxtngaa0.fkn.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH