346fb6182653bc824067fa2752028a5c6a432d3ee6bcd954070113b95026fa4b

Analysis

max time kernel
300s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
سند پیوست جهت بررسی و امضاpdf.js
Size 2.0MB
Sample260824-k93e8aem2x
SHA256 346fb6182653bc824067fa2752028a5c6a432d3ee6bcd954070113b95026fa4b
MD5 a1562e64f7071b58f3690de5b36fda78
SHA1 4ec507beffa918a9cd05233fe21894c9b73eedc9
SHA512 bf1181a70943f559c1c558aec4d374bc6f758a4cfd0083131f9c56fc3eb9b0687e79840c9778b7bc59704370d9eb5aebb88a5379b723ca69daa00b5f9c3cd84f
SSDEEP 6144:8fbtRh8cwoHxi2dDApxDJvJk9yX8JdRtV6WHx1UTyZ:8fbtRhdHg2dDApFJxk9ysJ7tEWR17
TLSH
T11FA5C83EEF8171ABD632C9114BC57013C19BBB43136E489C18DA1F9C0AD628A7ED665F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5088	powershell.exe
9	5088	powershell.exe
10	5088	powershell.exe
11	5088	powershell.exe
12	5088	powershell.exe
14	5088	powershell.exe
15	5088	powershell.exe
16	5088	powershell.exe
17	5088	powershell.exe
18	5088	powershell.exe
19	5088	powershell.exe
20	5088	powershell.exe
21	5088	powershell.exe
23	5088	powershell.exe
24	5088	powershell.exe
25	5088	powershell.exe
26	5088	powershell.exe
27	5088	powershell.exe
28	5088	powershell.exe
29	5088	powershell.exe
30	5088	powershell.exe
31	5088	powershell.exe
32	5088	powershell.exe
33	5088	powershell.exe
34	5088	powershell.exe
35	5088	powershell.exe
36	5088	powershell.exe
37	5088	powershell.exe
38	5088	powershell.exe
39	5088	powershell.exe
40	5088	powershell.exe
41	5088	powershell.exe
42	5088	powershell.exe
43	5088	powershell.exe
44	5088	powershell.exe
45	5088	powershell.exe
46	5088	powershell.exe
47	5088	powershell.exe
48	5088	powershell.exe
49	5088	powershell.exe
50	5088	powershell.exe
51	5088	powershell.exe
52	5088	powershell.exe
53	5088	powershell.exe
54	5088	powershell.exe
55	5088	powershell.exe
56	5088	powershell.exe
57	5088	powershell.exe
58	5088	powershell.exe
59	5088	powershell.exe
60	5088	powershell.exe
61	5088	powershell.exe
62	5088	powershell.exe
63	5088	powershell.exe
64	5088	powershell.exe
65	5088	powershell.exe
66	5088	powershell.exe
67	5088	powershell.exe
68	5088	powershell.exe
69	5088	powershell.exe
70	5088	powershell.exe
71	5088	powershell.exe
72	5088	powershell.exe
73	5088	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5088	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	powershell.exe
5088	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5260 wrote to memory of 4124	5260	wscript.exe	89
PID 4124 wrote to memory of 5088	4124	conhost.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\سند پیوست جهت بررسی و امضاpdf.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\v0umt70xr1z\v0umt70xr1z.ps1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\v0umt70xr1z\v0umt70xr1z.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5088

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v0umt70xr1z.ps1

Path C:\Users\Admin\AppData\Local\Temp\v0umt70xr1z\v0umt70xr1z.ps1
Size 1KB
SHA256 c3c3196d6746116f69afbf8cb408b0b7ddca95836f1b03823f4260a02654bfad
MD5 2915a28e216c265e67cb86d60d2349dc
SHA1 054430889a2ae16c062d0caa4d0dcc2389e4b93c
SHA512 8754bd22950303b27000981290f422d4b9ec7ffb33014b0eaf8fc8a9a3f80d215d383d7ed562ada9c4031c9227b029e56267aeb2ef23b6d407b521daf5a27dca
TLSH
T199314F2322CBEEA9160894E3EBA1E54D85387D08F38DEBD5F78DD00662C14C5E6D4387
MD5 SHA1 SHA512 TLSH

Submit Download

v0umt70xr1za

Path C:\Users\Admin\AppData\Local\Temp\v0umt70xr1z\v0umt70xr1za
Size 63KB
SHA256 4dcc57372a3e0dbc85af8edd9bd5ea0597ea93ff450a3a9a4c09127d643320a5
MD5 70f53849b5aa70a7e8ec84a851765c77
SHA1 a4aa9efddb4cc15322e4b651fa00200e252b3430
SHA512 26ede00381f0217bb60683fa391f358cb729d6173b524efa55479ae83b7edd8b3567a724877ecf28145afadfebbbb744e23ee9337c929615a0f47125b2452481
SSDEEP 768:mhs58prBhQ9T9ZzQ1C05ycaKCYi0aTIbHmyBUBTbjBb1YU8VDkf2ljdxGII5Gbll:DU43eCya70fhUB3jJKUGkIGfE
TLSH
T11C53028A3A7F8CB43BDCCA1898264DF7D5C9DCC58818AE61B3D539E0569CB12CCD3949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v0umt70xr1zb

Path C:\Users\Admin\AppData\Local\Temp\v0umt70xr1z\v0umt70xr1zb
Size 63KB
SHA256 876db2b1d8b967d583836a46388b9fcde7c723e1d4b541ec5b8c4d0542d6abf2
MD5 fdb3df30c79c08bb61a9ba3170972394
SHA1 ebb6417db95219c183687b92c42ddeb739843869
SHA512 90a050faf444006e02c7dd81484974dbcda3ac3b8c8add310aafbb75e47ec53c7a5fc065603248756e8e7ea247a8ff74c6ab79d9aed85c14d8c5d05fc95e966b
SSDEEP 1536:2eSmPa/1JlCCmtJVPnFuJOA8uWe5ytKgYC40F/jRgvFS4NVhQP:Ra9J1KVvFu98uWeAtjYqjqXmP
TLSH
T1CB531263DBA43F568A59F123CA8C01CF12739C53C34992FB0585DA795783AB0E70969E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5088-9-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-16-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-10-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-8-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-5-0x0000020232490000-0x00000202324B2000-memory.dmp

Download

memory/5088-4-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-15-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-3-0x00007FFCEB4CF000-0x00007FFCEB4D0000-memory.dmp

Download

memory/5088-17-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-12-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-18-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-19-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-20-0x000002024A7B0000-0x000002024A7FE000-memory.dmp

Download

memory/5088-21-0x00000202324E0000-0x00000202324F2000-memory.dmp

Download

memory/5088-23-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/5088-24-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download