Analysis
- max time kernel
300s - max time network
302s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 09:14
General
- Target OC-97364.js
- Size 990KB
- Sample260910-k7e7xatya1
- SHA256 ab35fae5a6142cd1ece0556f6d16bb2480e699accd643d7c15f7cedf992fbc70
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\OC-97364.js1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\v38i9uhc\log_57812_bea8.cmd1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\v38i9uhc\run_86712_be8e.dat" "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -w h -Command -2⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dat_65973_be8e
log_57812_bea8.cmd
run_86712_be8e.dat
tmp_57507_be8e
memory/1940-18-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-21-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-12-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-13-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-14-0x000002467B7E0000-0x000002467B828000-memory.dmp
memory/1940-9-0x000002467B260000-0x000002467B282000-memory.dmp
memory/1940-16-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-17-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-10-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-19-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-20-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-11-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-22-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-23-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-24-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-28-0x000002467B790000-0x000002467B7AA000-memory.dmp
memory/1940-29-0x000002467B250000-0x000002467B258000-memory.dmp
memory/1940-6-0x00007FFA5882F000-0x00007FFA58830000-memory.dmp
memory/1940-26-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-25-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-30-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/1940-33-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp
memory/5020-31-0x0000000000400000-0x0000000000496000-memory.dmp