0c392501e313ce6e687fae51258a6c9f9f3ac494afab4e0c844f29628705fd4c

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 22:53

Target
Comprobante de pago.js
Size 926KB
Sample260907-2vc1fsxbpc
SHA256 0c392501e313ce6e687fae51258a6c9f9f3ac494afab4e0c844f29628705fd4c
MD5 282117be943c4ccea474f9a9adc01f97
SHA1 bd1c8c660b520690f02704de09d83c21a1232100
SHA512 21aafd5e2067c52026669a93ffbf390455b7e9ed798b2f5115d99add4a3adfa337b36dd6de4bf750268b1b3eb9ad7167fb409ce10fe04a07f9d95fcd9b651c48
SSDEEP 6144:Lnynyn0nynnnynyncnynynynynWnynanynZnynyninynynynynknynEnyn3nyny5:HlZE6NDnF/QCdpOTg
TLSH
T1C115F80B0B3C377BAFA503611468C14953E88EC5DC729F48662DD4B8AE74E1F26A56FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5892	wscript.exe
3	5892	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Comprobante de pago.js"
1⤵
- Badlisted process makes network request
PID:5892

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact