38d910bef785cfb56ad747df5492fc9abcf0f2e88910931d19dc38bc54bee523

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AOS-LPO-556-26_Purchase Order.js
Size 2.0MB
Sample260826-arn5rs1blc
SHA256 38d910bef785cfb56ad747df5492fc9abcf0f2e88910931d19dc38bc54bee523
MD5 2256594b7b6dd9ff9410d80e11c76495
SHA1 ad700d468d8c9dd07cb1fb1d2ff995547e5b032c
SHA512 bba3b0d6c5e334b38ac2d9966a683adcc0bb0ab1973a5691a2ef47ac90fc9c47d357e2c897a0f08dd589c9cd30d8493cb833a3263a5e4d986005f99048f1e563
SSDEEP 6144:hSmYfRa/anJd4FUEqwrBkZl+Lz7igJvsXQIjnmccqG:hbYfs/anJd4FFqwrBkZO1JvsXQID1cqG
TLSH
T17EA5C53EDE63D1AB1637DD30C985245283297211115E3CEA89D62FAC4BA3B077CEB85D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4036 created 4656	4036	powershell.exe	80

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4036	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4036	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4036	powershell.exe
4036	powershell.exe
4036	powershell.exe
4036	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4036	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4036	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 2360	3124	wscript.exe	88
PID 2360 wrote to memory of 4036	2360	conhost.exe	89
PID 4036 wrote to memory of 1440	4036	powershell.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4656
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\AOS-LPO-556-26_Purchase Order.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\1kbjmt9ctcys\1kbjmt9ctcys.ps1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\1kbjmt9ctcys\1kbjmt9ctcys.ps1
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4036
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:1440

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1kbjmt9ctcys.ps1

Path C:\Users\Admin\AppData\Local\Temp\1kbjmt9ctcys\1kbjmt9ctcys.ps1
Size 1KB
SHA256 dd4d15a37b29fd40bacb24587fc7b32c99bfce45154f78a2f4265e2d08a0d9c3
MD5 afa5101655c01fba26f48836f3a03f9a
SHA1 687c4f5513b6fcf902575bc183810e6f7b8596cd
SHA512 249f0bf355dcd3b5b002112c6a30ab3ba229aad9ba7f19e03b0f0cfa1966341da8f49a6e27fb4d3ecfd61e0b3b53754ae388e5a82ab19a2746f607465bb3858d
TLSH
T1A831F5204283CB780957A073D572A9E68BB0980CBEAEFFC5761EC8095146554B8863CA
MD5 SHA1 SHA512 TLSH

Submit Download

1kbjmt9ctcysa

Path C:\Users\Admin\AppData\Local\Temp\1kbjmt9ctcys\1kbjmt9ctcysa
Size 67KB
SHA256 4ab883e78df3fbe56fb25d392815e4267081ca351c8419bb7204b6971951867e
MD5 b1f8dbeaaffc8226f7b7be944691fc8c
SHA1 cea7034078a99394e1d4fd43da29b0e79e4fc1ee
SHA512 ded4451fede0b8aa4c199ff5b18cb591a4cf3e65d1dd85926a8ae8169e366e44fd6113d33b3f6dbfb988f3584df642ba367b0364712cfa87204b8317ec680c92
SSDEEP 1536:Kcun8ROkvECVOWfTfzMnGzmoGGsQVm6yS+HGrAjHqEL:KcA8RYxWfTfzMGaEBVqkdG
TLSH
T17E63F15AA8A63E7D6300679BDE258FEE68C45E3880A4D8D648DC351FC43BEC73B1D811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1kbjmt9ctcysb

Path C:\Users\Admin\AppData\Local\Temp\1kbjmt9ctcys\1kbjmt9ctcysb
Size 67KB
SHA256 a245ee98d7a80034e9484aa249c6497a66abb0b012b4afdd47e9f8b012ae305d
MD5 ddf962303917b6e222001b8463474bd1
SHA1 ead8d3fb8532893f21666c89bc52fa7f3bde0544
SHA512 d194e3a166ab72dcdb69a5479609a48d5dad05862cbe18c610f82e3eca0b2bcbdd67824f3b6e333f3e2a7b83cce843ecdd087d104ef085e0d96c9e90f9f1d343
SSDEEP 1536:uWGDDFtEn2Ob5jz3GqRVDxF+Vwj5qg0OleQ2OMc7:JQE2Ob5jzHDn+VwQoXr7
TLSH
T16C63F1B0FEEFF52F859D66DE10075C6DFBEA82F6014485871F14AFC3069A23522689E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4036-10-0x00000142768F0000-0x0000014276912000-memory.dmp

Download

memory/4036-19-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-3-0x00007FFEB781F000-0x00007FFEB7820000-memory.dmp

Download

memory/4036-11-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-6-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-12-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-16-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-17-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-18-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-7-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-20-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-21-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-5-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-4-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/4036-23-0x000001425E400000-0x000001425E412000-memory.dmp

Download

memory/4036-22-0x0000014276C90000-0x0000014276CE2000-memory.dmp

Download

memory/4036-25-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download