0140c873a5b2d498b28ad07c66848146edb650968410e5804bc4e235cf68d9ac

Analysis

max time kernel
149s
max time network
95s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Doc_File810398TT103.js
Size 63KB
Sample260917-shetva1tcs
SHA256 0140c873a5b2d498b28ad07c66848146edb650968410e5804bc4e235cf68d9ac
MD5 2d40d1f54394ee868e84dc3366b2c1ea
SHA1 7a43842812de735669746a63f74c538a10270e8e
SHA512 ff5f660d6b54bf3917e9f9f7037eb4583b46b7c2f3225fdc290e868148d6b6e5ce040470e1f93f60b0aa00c17e6e3e29e0805fe03aa44a1d6037e85baafa7c42
SSDEEP 1536:tbsefr2WyNr+ayzMUlvRxmOhezBCGgLwRQeWZ7+RJjL5GC7t7rtDtAtstbtt:tbsefr2WyNr+ayzMUlvRxmOhe1CGgLwZ
TLSH
T1EE531EDE8BB3C0D68A0062918107E07DFDA3C522D627BEC2761975DEFF5CD6620B9660
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	2120	cmd.exe	88

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	5104	powershell.exe
2	5104	powershell.exe
4	5104	powershell.exe
5	5104	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5104-31-0x00000261EBCC0000-0x00000261EBCF2000-memory.dmp	SmartAssembly

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4468	cmd.exe
4220	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1044	taskkill.exe
2496	taskkill.exe
4896	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5104	powershell.exe
5104	powershell.exe
2928	powershell.exe
2928	powershell.exe
2928	powershell.exe
5104	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	2496	taskkill.exe
Token: SeDebugPrivilege	4896	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 5104	4468	cmd.exe	91
PID 5104 wrote to memory of 3512	5104	powershell.exe	92
PID 3512 wrote to memory of 1100	3512	csc.exe	93
PID 5104 wrote to memory of 2928	5104	powershell.exe	94
PID 2928 wrote to memory of 4220	2928	powershell.exe	96
PID 4220 wrote to memory of 1044	4220	cmd.exe	98
PID 4220 wrote to memory of 2496	4220	cmd.exe	99
PID 4220 wrote to memory of 4896	4220	cmd.exe	100

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Doc_File810398TT103.js
1⤵
PID:3808

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe .($env:ComSpec[4,26,25]-join'') $env:bSeIbAnkz;
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .($env:ComSpec[4,26,25]-join'') $env:bSeIbAnkz;
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yg43glvz\yg43glvz.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES195A.tmp" "c:\Users\Admin\AppData\Local\Temp\yg43glvz\CSCBF92ED87AA7493986F22E55E1334438.TMP"
      4⤵
      PID:1100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4220
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 856B
SHA256 c64e7c3c115c0ed9d2bd09b17a6ce08fda57626ae7238055ca7ca78a872110c3
MD5 08c4a8299519e6fc5f01024dab6a9273
SHA1 5a627d4a4008cd0a1176da74fdf7e0acfd1c00de
SHA512 d78f2598d8ee12ced76423c539fe38dd2a4b6689adb89ebf465cc998fb18431ea758db8010837c4c87a3378ac2e445f9384036133557f08dee774792b75bd1c6
TLSH
T193119732F38D8628DC59403A10DDED11373AC7CB415ADF6BBB84C151B807680CFA0260
MD5 SHA1 SHA512 TLSH

Submit Download

RES195A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES195A.tmp
Size 1KB
SHA256 15b360aafee3ddfb400c45fd2bbedbcebb31ecf9ce982d8a6fcba54af3547e64
MD5 5857ea4bc711e44d26ed60bf91edd42c
SHA1 2663f19d4536ac8fb444b06c2dce39ee0d9e0faf
SHA512 75867a62838dc59817fb11fa4e29815da97a8b2bc520e1ea7dcaffee1e3e8888bd6455fb30b2ecdd26777a181b73ccd5070610cf9036c193af232a855dca4cfc
TLSH
T1A221AB0593E9471FF0B3973169F6172BA274FD65DEB1936A884002292C41504EFF1FB6
MD5 SHA1 SHA512 TLSH

Submit Download

yg43glvz.dll

Path C:\Users\Admin\AppData\Local\Temp\yg43glvz\yg43glvz.dll
Size 3KB
SHA256 7005442380e8240e916eb7b292bb8efa511c5d1851e4231419fbc0a844a3cc36
MD5 5e8fe8e656840286e485ef81611b75ec
SHA1 917a32889737727676f5f85979d2c6c5c26f44a8
SHA512 2cc0cdba46a14069470aee3502e6aee482a2cc15887d2debec3eb89cbb481705cb9892124af38ae54dc9c7a984616d26904c7e2f7481c26413a9366f3a8a8366
TLSH
T10551DF1A53E8472BF4A707357EF743472774F9219B7253594C80026DAC213646E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBF92ED87AA7493986F22E55E1334438.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yg43glvz\CSCBF92ED87AA7493986F22E55E1334438.TMP
Size 652B
SHA256 10df67b6d43bcc916078aef51f73fea245d30226b0b700ed2c1406d9ebdc97c0
MD5 c990b6756efdc6a9210fd356c596c4d7
SHA1 d20832524d1eda0853650809909cd1d3de49e419
SHA512 ee5c5f5ad6b4611be05eed2715c2c32d1b20428e38b819645f00ec73766e84806391368299ba07ead623f25b9eaee52402ac6f0f44572256901eecb104d9e3a1
TLSH
T136F05E0963F8120EF4F34B30BDF643A391A8FC65DE3293ED18400319686451089B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

yg43glvz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yg43glvz\yg43glvz.0.cs
Size 213B
SHA256 a0fdb9548ff75cbf48acee5affaa578eb60798807cb792da4d9640cfb371f157
MD5 5406714dfd58ae688d2c3b98082fab53
SHA1 7661a7744b9c40379bb479ff527fc8923696cf11
SHA512 7f0c60c8508a7fe17edd1f08b9207464d8471f07d563acd20a7d971fc249731a4851b7d1a2000ffce1da712a55a8d161511b409bf985b4bf9a60bc83d5a3ccc7
TLSH
T1FDD0A9803686F3384B9305073C03B89A223FA71103EA6408D86A0C83EE08070BB38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

yg43glvz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yg43glvz\yg43glvz.cmdline
Size 369B
SHA256 993a46962923a947d19ed4e947a6695e50e92513122b94c4c110a939bf50b0ae
MD5 0e71e851485524fdd657b27d49a3f528
SHA1 cc13f95670cf9bd366e836a0f9e271569f3f5b42
SHA512 2c48ec51a66bcba0e662feb5cb6b81a9616bb568dd77138c2120d5683efe17db906b4a63185c52e9ef781a18fe803f582e5e4073bff33cdee36a5b5dec8f8f88
TLSH
T11DE0C63A8347C37D01EE100F32ABCCACD6720B9B69C43F84A040840FE027000ABD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5104-8-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-6-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-11-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-12-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-13-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-9-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-0-0x00007FFDB411F000-0x00007FFDB4120000-memory.dmp

Download

memory/5104-7-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-26-0x00000261EBB90000-0x00000261EBB98000-memory.dmp

Download

memory/5104-10-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-5-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-28-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-29-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-30-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-31-0x00000261EBCC0000-0x00000261EBCF2000-memory.dmp

Download

memory/5104-4-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/5104-3-0x00000261EBB40000-0x00000261EBB62000-memory.dmp

Download

memory/5104-38-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download