7ac3ee7407e452f00b71d19ded814b9c27ec691a02bc1a51923d73d1939d9a73

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHIPMENT.js
Size 684KB
Sample260930-j2jgps1djf
SHA256 7ac3ee7407e452f00b71d19ded814b9c27ec691a02bc1a51923d73d1939d9a73
MD5 c02f90e0214f9268517d9761e5eb48ab
SHA1 b576c5a53e83330b02fcd547c35efbe1b19a0061
SHA512 2a98ca55ef355f1ade81dfa607b7d66556b2588b98fec4e77285e8297abe9a1d9e1ffd142612dc30e6b66f3bea3c104e00070912b5d33c43ae63867fc62748cd
SSDEEP 12288:02pkH5xCMhwu8sbm+IiixFzt5M3RVTkjIQwWVG2CHMEM2CnxS:t/MhwuFBGxFzt5M3RVmRCsGCE
TLSH
T1F8E4E10D84031460BE6FBB35AADF679D01689FFA96ADD6F0D34E86D42275382C359E0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\NlsCacheWarm_AVAO = "C:\\Windows\\System32\\conhost.exe --headless -- C:\\Windows\\System32\\cmd.exe /c call \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\tile_db\\tile_db_APEIRWXBh.cmd\""	powershell.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4700	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3844	powershell.exe
2464	powershell.exe
6032	powershell.exe
3940	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2464	powershell.exe
2464	powershell.exe
6032	powershell.exe
3940	powershell.exe
6032	powershell.exe
3940	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe

Suspicious behavior: MapViewOfSection 1 TTPs 4 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	6032	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeIncreaseQuotaPrivilege	3844	powershell.exe
Token: SeSecurityPrivilege	3844	powershell.exe
Token: SeTakeOwnershipPrivilege	3844	powershell.exe
Token: SeLoadDriverPrivilege	3844	powershell.exe
Token: SeSystemProfilePrivilege	3844	powershell.exe
Token: SeSystemtimePrivilege	3844	powershell.exe
Token: SeProfSingleProcessPrivilege	3844	powershell.exe
Token: SeIncBasePriorityPrivilege	3844	powershell.exe
Token: SeCreatePagefilePrivilege	3844	powershell.exe
Token: SeBackupPrivilege	3844	powershell.exe
Token: SeRestorePrivilege	3844	powershell.exe
Token: SeShutdownPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeSystemEnvironmentPrivilege	3844	powershell.exe
Token: SeRemoteShutdownPrivilege	3844	powershell.exe
Token: SeUndockPrivilege	3844	powershell.exe
Token: SeManageVolumePrivilege	3844	powershell.exe
Token: 33	3844	powershell.exe
Token: 34	3844	powershell.exe
Token: 35	3844	powershell.exe
Token: 36	3844	powershell.exe
Token: SeIncreaseQuotaPrivilege	3844	powershell.exe
Token: SeSecurityPrivilege	3844	powershell.exe
Token: SeTakeOwnershipPrivilege	3844	powershell.exe
Token: SeLoadDriverPrivilege	3844	powershell.exe
Token: SeSystemProfilePrivilege	3844	powershell.exe
Token: SeSystemtimePrivilege	3844	powershell.exe
Token: SeProfSingleProcessPrivilege	3844	powershell.exe
Token: SeIncBasePriorityPrivilege	3844	powershell.exe
Token: SeCreatePagefilePrivilege	3844	powershell.exe
Token: SeBackupPrivilege	3844	powershell.exe
Token: SeRestorePrivilege	3844	powershell.exe
Token: SeShutdownPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeSystemEnvironmentPrivilege	3844	powershell.exe
Token: SeRemoteShutdownPrivilege	3844	powershell.exe
Token: SeUndockPrivilege	3844	powershell.exe
Token: SeManageVolumePrivilege	3844	powershell.exe
Token: 33	3844	powershell.exe
Token: 34	3844	powershell.exe
Token: 35	3844	powershell.exe
Token: 36	3844	powershell.exe
Token: SeIncreaseQuotaPrivilege	3844	powershell.exe
Token: SeSecurityPrivilege	3844	powershell.exe
Token: SeTakeOwnershipPrivilege	3844	powershell.exe
Token: SeLoadDriverPrivilege	3844	powershell.exe
Token: SeSystemProfilePrivilege	3844	powershell.exe
Token: SeSystemtimePrivilege	3844	powershell.exe
Token: SeProfSingleProcessPrivilege	3844	powershell.exe
Token: SeIncBasePriorityPrivilege	3844	powershell.exe
Token: SeCreatePagefilePrivilege	3844	powershell.exe
Token: SeBackupPrivilege	3844	powershell.exe
Token: SeRestorePrivilege	3844	powershell.exe
Token: SeShutdownPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeSystemEnvironmentPrivilege	3844	powershell.exe
Token: SeRemoteShutdownPrivilege	3844	powershell.exe
Token: SeUndockPrivilege	3844	powershell.exe
Token: SeManageVolumePrivilege	3844	powershell.exe
Token: 33	3844	powershell.exe

Suspicious use of UnmapMainImage 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
3844	powershell.exe
3844	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2464	4372	wscript.exe	89
PID 4372 wrote to memory of 4700	4372	wscript.exe	91
PID 4700 wrote to memory of 6032	4700	cmd.exe	93
PID 4700 wrote to memory of 3940	4700	cmd.exe	94
PID 3940 wrote to memory of 3844	3940	powershell.exe	95
PID 4700 wrote to memory of 1228	4700	cmd.exe	97
PID 3844 wrote to memory of 4364	3844	powershell.exe	98
PID 3844 wrote to memory of 1120	3844	powershell.exe	100

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1228	attrib.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\SHIPMENT.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ILRGJ))
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\15776785098532.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\15776785098532.cmd"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KQPDMNSHC));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:PQTTXCPS))"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KQPDMNSHC));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:PQTTXCPS))"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KQPDMNSHC));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:PQTTXCPS))"
      4⤵
      Adds Run key to start application
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:3844
    - - C:\Windows\SysWOW64\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        
        PID:4364
    - - C:\Windows\SysWOW64\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        
        PID:1120
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\15776785098532.cmd"
    3⤵
    - Views/modifies file attributes
    PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

15776785098532.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\15776785098532.cmd
Size 646KB
SHA256 7983c3e0fb44ade7b4156bf4a50fbfd9e4c4170a4929adf88871eac92c1fd916
MD5 6f676bebc69685dbd6bb0c7411cd5de6
SHA1 b96e72ac0393774cfc509a505cfaed81df44a79d
SHA512 2c8c489c9420047cbf861d907ff788340f1e6b26668ea7b9ab79ebe1f7680c60662a49c1095ca66b137a106f6b5ad596150b5422f6f67671d58a9770d42bd219
SSDEEP 12288:y2pkH5xCMhwu8sbm+IiixFzt5M3RVTkjIQwWVG2CHMEM2Cnd:T/MhwuFBGxFzt5M3RVmRCsGCd
TLSH
T106E4021DC80368807CFAFD7655AFBBDA122C47B3DBD6ABA1E18861E115763A5D00F90C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 1321a719825d2d8d2d9135e551e460635bdfeb75be0927c3df7bfb87c450b575
MD5 7e77eb6f40342772dc4bcf96f554af0f
SHA1 744fbbf1d38f6c69236842d3cc06e4136a197df7
SHA512 a839aed2c316ecda5423bb46e63af0b83cadf6af07467a765d2bf7ae99e458280535dbdc380b053d6c6c5c3452ff26c2e4f6946045530e0e3ee169643e78c212
TLSH
T1F7116633F3CC8624DC59403650CEAD1137B687CB40DEDE6B7B84D155B82F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1773ed80cb0074eb3b6f6627105671b7f0d70046a3f1e01845c21ca475e45a9f
MD5 1c2bd80a63f2233dde630dc65afbd4d2
SHA1 8632b4514e8771923309ec5c19c47155f7787379
SHA512 8a545ae360b118440367fd4fa285cdab60d723847a14f2613b564db0f9001f951d5986c18b5bac426b17e4cb75d6bc87a9b5aab9174c8951f2d9f45cec9c2255
TLSH
T164218937B3DC8610CC8A403A10CEAC1437B687DB80DECFABBB84D544B42F699CE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mew4dlso.3ue.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mew4dlso.3ue.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1120-68-0x00000000008E0000-0x0000000000920000-memory.dmp

Download

memory/1120-67-0x00000000008E0000-0x0000000000920000-memory.dmp

Download

memory/2464-12-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-14-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-7-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-8-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-9-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-10-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-11-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-0-0x00007FFC6729F000-0x00007FFC672A0000-memory.dmp

Download

memory/2464-13-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-3-0x000001A34EEA0000-0x000001A34EEC2000-memory.dmp

Download

memory/2464-15-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-16-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-17-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-20-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-4-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-2-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/2464-1-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp

Download

memory/3844-54-0x00000000079A0000-0x00000000079C0000-memory.dmp

Download

memory/3844-55-0x0000000007A40000-0x0000000007AE3000-memory.dmp

Download

memory/3844-39-0x0000000005F00000-0x000000000625B000-memory.dmp

Download

memory/3844-35-0x00000000057D0000-0x0000000005836000-memory.dmp

Download

memory/3844-32-0x0000000003100000-0x0000000003136000-memory.dmp

Download

memory/3844-34-0x0000000005600000-0x0000000005622000-memory.dmp

Download

memory/3844-43-0x0000000007D00000-0x000000000837C000-memory.dmp

Download

memory/3844-44-0x00000000069B0000-0x00000000069CA000-memory.dmp

Download

memory/3844-46-0x00000000076F0000-0x0000000007712000-memory.dmp

Download

memory/3844-45-0x0000000007760000-0x00000000077F6000-memory.dmp

Download

memory/3844-47-0x0000000008940000-0x0000000008EFA000-memory.dmp

Download

memory/3844-49-0x00000000079C0000-0x00000000079F6000-memory.dmp

Download

memory/3844-50-0x0000000070BC0000-0x0000000070C0C000-memory.dmp

Download

memory/3844-51-0x0000000070D20000-0x000000007107B000-memory.dmp

Download

memory/3844-42-0x0000000006400000-0x000000000644C000-memory.dmp

Download

memory/3844-36-0x0000000005E90000-0x0000000005EF6000-memory.dmp

Download

memory/3844-56-0x0000000007B30000-0x0000000007B3A000-memory.dmp

Download

memory/3844-57-0x0000000002C90000-0x0000000002CA1000-memory.dmp

Download

memory/3844-58-0x0000000007CE0000-0x0000000007CF0000-memory.dmp

Download

memory/3844-59-0x0000000008380000-0x0000000008395000-memory.dmp

Download

memory/3844-60-0x00000000083D0000-0x00000000083EC000-memory.dmp

Download

memory/3844-61-0x00000000083C0000-0x00000000083C8000-memory.dmp

Download

memory/3844-33-0x0000000005840000-0x0000000005E8A000-memory.dmp

Download

memory/3844-41-0x00000000063C0000-0x00000000063DE000-memory.dmp

Download

memory/4364-64-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4364-62-0x0000000000F60000-0x0000000000FA0000-memory.dmp

Download

memory/4364-63-0x0000000000F60000-0x0000000000FA0000-memory.dmp

Download

memory/4364-65-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4372-21-0x0000020BC4BB0000-0x0000020BC4FCE000-memory.dmp

Download

memory/4372-29-0x0000020BC4BB0000-0x0000020BC4FCE000-memory.dmp

Download