1cb325736cfca54a09bc0fc90b78f8295853c3aaaadd77da59b11566e600cfb2

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
899s
max time network
450s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Technical Drawings 3D items STP.jse
Size 239KB
Sample260916-jk4fjsvvf1
SHA256 1cb325736cfca54a09bc0fc90b78f8295853c3aaaadd77da59b11566e600cfb2
MD5 cb339b4844a8e925e961cecc58dfce44
SHA1 2da8b5ff764f6a30a80b5735e36a858c008d8b94
SHA512 851eaa50bf93591386360f7b5fbd6e2ba70c98e6d2fdb514d1860d9b45d2364c4d3cc41558ac431509785278e4bb0f949cd20ccf3cb0f7d863b17189e8d43d6f
SSDEEP 6144:MDMhRMy4Y41uqMQszfU7WHgISwnrP6HeqWr8:MfVWQ2fU7AOwrPmeqWr8
TLSH
T1A634FFC15392D46B175B8E122F067BD8B828DA7FF0D85E47F0B4BE0DA1A8619C5D4BB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection execution

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3424	powershell.exe
5	3424	powershell.exe
6	3424	powershell.exe
6	3424	powershell.exe
5	3424	powershell.exe
2	3424	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3424	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 8 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeIncreaseQuotaPrivilege	3424	powershell.exe
Token: SeSecurityPrivilege	3424	powershell.exe
Token: SeTakeOwnershipPrivilege	3424	powershell.exe
Token: SeLoadDriverPrivilege	3424	powershell.exe
Token: SeSystemProfilePrivilege	3424	powershell.exe
Token: SeSystemtimePrivilege	3424	powershell.exe
Token: SeProfSingleProcessPrivilege	3424	powershell.exe
Token: SeIncBasePriorityPrivilege	3424	powershell.exe
Token: SeCreatePagefilePrivilege	3424	powershell.exe
Token: SeBackupPrivilege	3424	powershell.exe
Token: SeRestorePrivilege	3424	powershell.exe
Token: SeShutdownPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeSystemEnvironmentPrivilege	3424	powershell.exe
Token: SeRemoteShutdownPrivilege	3424	powershell.exe
Token: SeUndockPrivilege	3424	powershell.exe
Token: SeManageVolumePrivilege	3424	powershell.exe
Token: 33	3424	powershell.exe
Token: 34	3424	powershell.exe
Token: 35	3424	powershell.exe
Token: 36	3424	powershell.exe
Token: SeIncreaseQuotaPrivilege	3424	powershell.exe
Token: SeSecurityPrivilege	3424	powershell.exe
Token: SeTakeOwnershipPrivilege	3424	powershell.exe
Token: SeLoadDriverPrivilege	3424	powershell.exe
Token: SeSystemProfilePrivilege	3424	powershell.exe
Token: SeSystemtimePrivilege	3424	powershell.exe
Token: SeProfSingleProcessPrivilege	3424	powershell.exe
Token: SeIncBasePriorityPrivilege	3424	powershell.exe
Token: SeCreatePagefilePrivilege	3424	powershell.exe
Token: SeBackupPrivilege	3424	powershell.exe
Token: SeRestorePrivilege	3424	powershell.exe
Token: SeShutdownPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeSystemEnvironmentPrivilege	3424	powershell.exe
Token: SeRemoteShutdownPrivilege	3424	powershell.exe
Token: SeUndockPrivilege	3424	powershell.exe
Token: SeManageVolumePrivilege	3424	powershell.exe
Token: 33	3424	powershell.exe
Token: 34	3424	powershell.exe
Token: 35	3424	powershell.exe
Token: 36	3424	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 3424	2400	WScript.exe	90
PID 3424 wrote to memory of 5544	3424	powershell.exe	100
PID 3424 wrote to memory of 5544	3424	powershell.exe	100
PID 3424 wrote to memory of 3948	3424	powershell.exe	104
PID 3424 wrote to memory of 3948	3424	powershell.exe	104

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\Technical Drawings 3D items STP.jse"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command -
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3704

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3424-0-0x00000188D9B1C000-0x00000188D9B1D000-memory.dmp

Download

memory/3424-1-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-4-0x00000188F2090000-0x00000188F20B2000-memory.dmp

Download

memory/3424-5-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-6-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-7-0x00000188F24F0000-0x00000188F2538000-memory.dmp

Download

memory/3424-8-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-9-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-13-0x00000188F2540000-0x00000188F25F2000-memory.dmp

Download

memory/3424-12-0x00000188F24C0000-0x00000188F24DE000-memory.dmp

Download

memory/3424-14-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-15-0x00000188F24B0000-0x00000188F24BA000-memory.dmp

Download

memory/3424-16-0x00000188F2730000-0x00000188F274E000-memory.dmp

Download

memory/3424-17-0x00000188F24E0000-0x00000188F24EA000-memory.dmp

Download

memory/3424-18-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-20-0x00000188F2750000-0x00000188F276C000-memory.dmp

Download

memory/3424-19-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-21-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-22-0x00000188F2600000-0x00000188F2608000-memory.dmp

Download

memory/3424-24-0x00000188F2620000-0x00000188F262A000-memory.dmp

Download

memory/3424-23-0x00000188F2610000-0x00000188F2616000-memory.dmp

Download

memory/3424-25-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-26-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-27-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-28-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-30-0x00000188F2600000-0x00000188F2624000-memory.dmp

Download

memory/3424-29-0x00000188F2600000-0x00000188F262A000-memory.dmp

Download

memory/3424-31-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-32-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-33-0x00000188F2BC0000-0x00000188F2C10000-memory.dmp

Download

memory/3424-34-0x00000188F2DE0000-0x00000188F2FA2000-memory.dmp

Download

memory/3424-35-0x00000188F34E0000-0x00000188F3A08000-memory.dmp

Download

memory/3424-37-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-38-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-39-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-40-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-41-0x00000188F2610000-0x00000188F2618000-memory.dmp

Download

memory/3424-42-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-43-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-44-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-45-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-47-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-46-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-48-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-49-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-51-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download

memory/3424-52-0x00000188D9380000-0x00000188D9D24000-memory.dmp

Download