06ac3f97223310f9f49612d413a2b568457faee0ecb06cb73e6dde2e0bf4eeb1

Analysis

max time kernel
5s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SNK09876545678900.js
Size 1.9MB
Sample260830-mt6h2styay
SHA256 06ac3f97223310f9f49612d413a2b568457faee0ecb06cb73e6dde2e0bf4eeb1
MD5 4ba1e8fe61c8eb9831bfcd4fd0e456f5
SHA1 1d2dc624ed7e8b50d0f28949238f72e64cc670a0
SHA512 346e19ff2b3c0ef4d625144065907003414ab23aeb60405023650b913f58a1c39f8d0fd2bdda78be9f299aedbf36ed61829566c022f2a17257c7360d341e9254
SSDEEP 24576:OU+aoFuQYcZsnVFVsxUA83yONBKMD0n7zT37KjdI:2/AUuPy/5
TLSH
T10D957C0B0B3C237B9FA10362146DD50953F84AC5D877AF492A2ED4B46E74E1F26A85FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2276	support.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2108	cmd.exe
2616	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3944	schtasks.exe
4980	schtasks.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 2108	3764	wscript.exe	87
PID 2108 wrote to memory of 3944	2108	cmd.exe	89
PID 2100 wrote to memory of 2616	2100	WScript.exe	92
PID 3764 wrote to memory of 2276	3764	wscript.exe	94
PID 2616 wrote to memory of 4980	2616	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\SNK09876545678900.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 15 /tn SNK09876545678900.js /tr C:\Users\Admin\Pictures\SNK09876545678900.js /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 15 /tn SNK09876545678900.js /tr C:\Users\Admin\Pictures\SNK09876545678900.js /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3944
- C:\Users\Admin\AppData\Roaming\support.exe
  "C:\Users\Admin\AppData\Roaming\support.exe" "C:\Users\Admin\AppData\Roaming\au.dat"
  2⤵
  - Executes dropped EXE
  PID:2276

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Pictures\SNK09876545678900.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 15 /tn SNK09876545678900.js /tr C:\Users\Admin\Pictures\SNK09876545678900.js /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 15 /tn SNK09876545678900.js /tr C:\Users\Admin\Pictures\SNK09876545678900.js /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.zip

Path C:\Users\Admin\AppData\Roaming\app.zip
Size 532KB
SHA256 13c9cdd4e8901593bd24850bda875ff8d7e7beeed97f0e2ff7df6bc701b8852a
MD5 2395782ecb642c10ceb9223a67dda8b3
SHA1 19ccec8eac263881022cfb2650c135d42cdfb952
SHA512 15efb0c2b961a96998f210dd3e67cf78b4bb3efaf8427d289d7e580e0434f80bfb4af0e6484bff621dc30caa91b490ac5b7e185e99e818bc4e47f612ed2357be
SSDEEP 12288:117jChsIcTbJZAvq8xEWCnmld08+2yFluGE8kqV:1dhbudxRemld08FEluGE18
TLSH
T191C4232315169E6B206C2E9B76729435ACB226589C7F445BD900F2473B4BA0B334FDBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

au.dat

Path C:\Users\Admin\AppData\Roaming\au.dat
Size 31KB
SHA256 17aa220bcb1d6ad42fb116d8fa235ae9a3685b9f46209cd6694ca30b95d78a1e
MD5 7aeec7f5bf370e0dc7505aeeda60681e
SHA1 783e84092bf5f342b46d93d95ac7d605f24a5d54
SHA512 12c8bbbeca244cc64762d58a43068f267bf41ff84c46b7ecb4c7817bc05ad15c28b2e098ed98f1a5665422bd3517d1c504766df40f0bc76d2da884d5943b1941
SSDEEP 96:X+mKJ+Or5bHIk1fIB5cJ0qIxrcxXImUGZrSYImMmkWUVSVWvrVX:juscJercx1UqrSi7Ed
TLSH
T169E2FFC91D1B658F125E753B121FD8CE29692B39C0F98126F23F9AB6D01D159EBE43C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

au.ini

Path C:\Users\Admin\AppData\Roaming\au.ini
Size 82KB
SHA256 a0409b392969ca38160056a95bc80e1a16224754d94791eb972e16a54e2f75f4
MD5 dbce19bf59d7a481c3f69694f5f9084e
SHA1 cec1352dfa16dcb098a4ad21b630fc8e9bc2f361
SHA512 ee88f5a7ab0158cf0c56d6b445531bf334f9316996eac06e5f6b130d864a4fdd4e70422413dd55ba0ff6ffa4090f257bb4f19f2ca2e48d6de52dcb5b29a89716
SSDEEP 1536:lxjMLGhM0UGOxTlO7vxgI3Dq6jFhfSGhYzwZMWin4lGjQAnN:lxjMLyMFnSxzqIqzhWin4lGjQkN
TLSH
T15C83025DA7CA13205617E756C8A44305DC4ADA3C197DE30F366BED1AE5043EA832CADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

support.exe

Path C:\Users\Admin\AppData\Roaming\support.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SNK09876545678900.js

Path C:\Users\Admin\Pictures\SNK09876545678900.js
Size 1.9MB
SHA256 06ac3f97223310f9f49612d413a2b568457faee0ecb06cb73e6dde2e0bf4eeb1
MD5 4ba1e8fe61c8eb9831bfcd4fd0e456f5
SHA1 1d2dc624ed7e8b50d0f28949238f72e64cc670a0
SHA512 346e19ff2b3c0ef4d625144065907003414ab23aeb60405023650b913f58a1c39f8d0fd2bdda78be9f299aedbf36ed61829566c022f2a17257c7360d341e9254
SSDEEP 24576:OU+aoFuQYcZsnVFVsxUA83yONBKMD0n7zT37KjdI:2/AUuPy/5
TLSH
T10D957C0B0B3C237B9FA10362146DD50953F84AC5D877AF492A2ED4B46E74E1F26A85FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2276-68-0x000002CF62FC0000-0x000002CF62FD5000-memory.dmp

Download

memory/2276-69-0x000002CF62FC0000-0x000002CF62FD5000-memory.dmp

Download

memory/2276-67-0x000002CF62FC0000-0x000002CF62FD5000-memory.dmp

Download

memory/2276-66-0x000002CF62FC0000-0x000002CF62FD5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads