Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 15:12
General
- Target Termeni contractuali modificați-pdf.js
- Size 85KB
- Sample260922-slaz3aha73
- SHA256 a206468074ed5ba3dd2a58f0c6b1de89f229aed0f458d1f7f5f495fbd3c35ca6
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 11 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Termeni contractuali modificați-pdf.js"1⤵
- Badlisted process makes network request
-
C:\Windows\system32\cmd.execmd.exe /c echo ^%koordinator^% | %Parisian% -1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo %koordinator% "2⤵
-
-
\??\c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -2⤵
- Badlisted process makes network request
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_cptmaltd.whn.ps1
memory/5428-6-0x0000000005890000-0x00000000058B2000-memory.dmp
memory/5428-18-0x0000000006050000-0x000000000609C000-memory.dmp
memory/5428-5-0x00000000051F0000-0x000000000583A000-memory.dmp
memory/5428-2-0x0000000074612000-0x0000000074613000-memory.dmp
memory/5428-9-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/5428-8-0x00000000059A0000-0x0000000005A06000-memory.dmp
memory/5428-7-0x0000000005930000-0x0000000005996000-memory.dmp
memory/5428-3-0x00000000027A0000-0x00000000027D6000-memory.dmp
memory/5428-4-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/5428-15-0x0000000005AD0000-0x0000000005E2B000-memory.dmp
memory/5428-17-0x0000000006010000-0x000000000602E000-memory.dmp
memory/5428-19-0x00000000078D0000-0x0000000007F4C000-memory.dmp
memory/5428-20-0x00000000065B0000-0x00000000065CA000-memory.dmp
memory/5428-21-0x0000000007300000-0x0000000007396000-memory.dmp
memory/5428-22-0x0000000007260000-0x0000000007282000-memory.dmp
memory/5428-23-0x0000000008510000-0x0000000008ACA000-memory.dmp
memory/5428-24-0x0000000074612000-0x0000000074613000-memory.dmp
memory/5428-25-0x0000000074600000-0x0000000074DBC000-memory.dmp