45638f045a1b11236613a326183ea40d7e3652c16eb2ad81c7a697c5adab60bd

Resubmissions

31/08/2026, 18:58

260831-xml6ya1vaw10

31/08/2026, 12:15

260831-pfc1pahr5y10

Analysis

max time kernel
899s
max time network
899s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45638f045a1b11236613a326183ea40d7e3652c16eb2ad81c7a697c5adab60bd.js
Size 94KB
Sample260831-xml6ya1vaw
SHA256 45638f045a1b11236613a326183ea40d7e3652c16eb2ad81c7a697c5adab60bd
MD5 aa0533091822bdfdf38d4ac4a0fc2a08
SHA1 d9ec26514ce5c96d7a42ab3e8167346b0887d96d
SHA512 59df6387b431aff9107cb48e1ab131107405cd32d35ee3ac4270cedf04b71c748e40a53532c1dd930029abfc4dcab341979f5017a9910d9d4bde3260555ccc26
SSDEEP 1536:L1aGZeLiqauYec9Zw0mOUuQeDi3zt326G3imAHUvuf8xcmUjJ7NUy6:L9Zz1dfmOUuxDiMhSmAHYuf8xbUt7NU9
TLSH
T138934C22ED30017A8F4BA75ABDE105A1CAA9E714453250F4F1DFC74D52099ECF7B82AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	4636	cmd.exe	84

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4580	powershell.exe
9	4580	powershell.exe
11	4580	powershell.exe
12	4580	powershell.exe
13	4580	powershell.exe
14	4580	powershell.exe
15	4580	powershell.exe
16	4580	powershell.exe
17	4580	powershell.exe
18	4580	powershell.exe
20	4580	powershell.exe
21	4580	powershell.exe
22	4580	powershell.exe
24	4580	powershell.exe
25	4580	powershell.exe
26	4580	powershell.exe
27	4580	powershell.exe
28	4580	powershell.exe
29	4580	powershell.exe
30	4580	powershell.exe
31	4580	powershell.exe
32	4580	powershell.exe
33	4580	powershell.exe
34	4580	powershell.exe
35	4580	powershell.exe
36	4580	powershell.exe
37	4580	powershell.exe
38	4580	powershell.exe
39	4580	powershell.exe
40	4580	powershell.exe
41	4580	powershell.exe
42	4580	powershell.exe
43	4580	powershell.exe
43	4580	powershell.exe
47	4580	powershell.exe
48	4580	powershell.exe
52	4580	powershell.exe
53	4580	powershell.exe
54	4580	powershell.exe
55	4580	powershell.exe
56	4580	powershell.exe
57	4580	powershell.exe
58	4580	powershell.exe
59	4580	powershell.exe
60	4580	powershell.exe
61	4580	powershell.exe
62	4580	powershell.exe
63	4580	powershell.exe
64	4580	powershell.exe
65	4580	powershell.exe
66	4580	powershell.exe
67	4580	powershell.exe
68	4580	powershell.exe
69	4580	powershell.exe
70	4580	powershell.exe
71	4580	powershell.exe
72	4580	powershell.exe
73	4580	powershell.exe
74	4580	powershell.exe
75	4580	powershell.exe
76	4580	powershell.exe
77	4580	powershell.exe
78	4580	powershell.exe
79	4580	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\__PSScriptPolicyTest_2lfd01qh.iuz.ps1	powershell.exe
File created	C:\Windows\__PSScriptPolicyTest_agm5f0ym.wix.psm1	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1800	2056	cmd.exe	92
PID 2056 wrote to memory of 4580	2056	cmd.exe	93

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\45638f045a1b11236613a326183ea40d7e3652c16eb2ad81c7a697c5adab60bd.js
1⤵
PID:4828

C:\Windows\system32\cmd.exe
cmd.exe /c echo ^%Eksistensbegrebernes^% | %Uninvoiced% -
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo %Eksistensbegrebernes% "
  2⤵
  PID:1800
- \??\c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
  "c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -
  2⤵
  - Badlisted process makes network request
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:628

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4580-0-0x0000000074322000-0x0000000074323000-memory.dmp

Download

memory/4580-1-0x0000000002D50000-0x0000000002D86000-memory.dmp

Download

memory/4580-2-0x0000000074310000-0x0000000074ACC000-memory.dmp

Download

memory/4580-3-0x0000000005770000-0x0000000005DBA000-memory.dmp

Download

memory/4580-4-0x0000000074310000-0x0000000074ACC000-memory.dmp

Download

memory/4580-5-0x0000000005DF0000-0x0000000005E12000-memory.dmp

Download

memory/4580-7-0x0000000006000000-0x0000000006066000-memory.dmp

Download

memory/4580-6-0x0000000005F90000-0x0000000005FF6000-memory.dmp

Download

memory/4580-10-0x0000000006240000-0x000000000659B000-memory.dmp

Download

memory/4580-12-0x00000000065A0000-0x00000000065EC000-memory.dmp

Download

memory/4580-11-0x00000000061E0000-0x00000000061FE000-memory.dmp

Download

memory/4580-13-0x0000000007F10000-0x000000000858C000-memory.dmp

Download

memory/4580-14-0x0000000006B10000-0x0000000006B2A000-memory.dmp

Download

memory/4580-15-0x00000000075D0000-0x0000000007666000-memory.dmp

Download

memory/4580-16-0x0000000007560000-0x0000000007582000-memory.dmp

Download

memory/4580-17-0x0000000008590000-0x0000000008B4A000-memory.dmp

Download

memory/4580-18-0x0000000074322000-0x0000000074323000-memory.dmp

Download

memory/4580-19-0x0000000074310000-0x0000000074ACC000-memory.dmp

Download