Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 08:28
Static task
static1
Behavioral task
behavioral1
Sample
Thư Yêu Cầu Mua HàngF.js
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Thư Yêu Cầu Mua HàngF.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Thư Yêu Cầu Mua HàngF.js
- Size 780KB
- Sample260930-kc55vasdmg
- SHA256 42f0e94c6a4e1d4b05ae29ecb3b67ff7ae3cbcc6002e959b7882a96d49cc2913
- MD5 3891eb8ef4d5eab6765ba6ca17ef3378
- SHA1 5b4b54affbddd1463b07c9fefe68caea8b71aad1
- SHA512 e1d6efb8c0aa3041ddef7c99b78ab00e3de341400db55593323fb4551f4cea72a5b72253b9780f8de5b90a9b9ae9986a55c66ea1c60f98695772def5893afac4
- SSDEEP 12288:5JKFiyTWnpQ3RECXrslPPftH1KfaDpyEM2xL8qfFTFplQ4VCMA/B0v:HKFr2cEmshtHQyU/2xL86p3DPAJe
- TLSH T1DD05E1202539E02F467BC11163AA624C99BD97458619F61E703DD2F24FFB0B522A7FCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
lxbaserat
Version
-
1.0.41
Botnet
-
Group1
Campaign
-
1890e289a8e24876b03f7195f1d5a1e5
C2
-
64.89.160.127:4561
Attributes
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
dxwloGHWdUH6yaQyyWMV
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation wscript.exe - Loads dropped DLL 1 IoCs
pid Process 3996 chrome.exe - Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe - Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ wscript.exe \??\F:\ powershell.exe \??\F:\ wscript.exe - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ip-api.com - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4620 set thread context of 1144 4620 powershell.exe 99 - Command and Scripting Interpreter: JavaScript 1 TTPs
-
pid Process 4620 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1144 MSBuild.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4620 powershell.exe 4620 powershell.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe 1144 MSBuild.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4620 powershell.exe Token: SeDebugPrivilege 1144 MSBuild.exe Token: SeIncreaseQuotaPrivilege 4404 wmic.exe Token: SeSecurityPrivilege 4404 wmic.exe Token: SeTakeOwnershipPrivilege 4404 wmic.exe Token: SeLoadDriverPrivilege 4404 wmic.exe Token: SeSystemProfilePrivilege 4404 wmic.exe Token: SeSystemtimePrivilege 4404 wmic.exe Token: SeProfSingleProcessPrivilege 4404 wmic.exe Token: SeIncBasePriorityPrivilege 4404 wmic.exe Token: SeCreatePagefilePrivilege 4404 wmic.exe Token: SeBackupPrivilege 4404 wmic.exe Token: SeRestorePrivilege 4404 wmic.exe Token: SeShutdownPrivilege 4404 wmic.exe Token: SeDebugPrivilege 4404 wmic.exe Token: SeSystemEnvironmentPrivilege 4404 wmic.exe Token: SeRemoteShutdownPrivilege 4404 wmic.exe Token: SeUndockPrivilege 4404 wmic.exe Token: SeManageVolumePrivilege 4404 wmic.exe Token: 33 4404 wmic.exe Token: 34 4404 wmic.exe Token: 35 4404 wmic.exe Token: 36 4404 wmic.exe Token: SeIncreaseQuotaPrivilege 4404 wmic.exe Token: SeSecurityPrivilege 4404 wmic.exe Token: SeTakeOwnershipPrivilege 4404 wmic.exe Token: SeLoadDriverPrivilege 4404 wmic.exe Token: SeSystemProfilePrivilege 4404 wmic.exe Token: SeSystemtimePrivilege 4404 wmic.exe Token: SeProfSingleProcessPrivilege 4404 wmic.exe Token: SeIncBasePriorityPrivilege 4404 wmic.exe Token: SeCreatePagefilePrivilege 4404 wmic.exe Token: SeBackupPrivilege 4404 wmic.exe Token: SeRestorePrivilege 4404 wmic.exe Token: SeShutdownPrivilege 4404 wmic.exe Token: SeDebugPrivilege 4404 wmic.exe Token: SeSystemEnvironmentPrivilege 4404 wmic.exe Token: SeRemoteShutdownPrivilege 4404 wmic.exe Token: SeUndockPrivilege 4404 wmic.exe Token: SeManageVolumePrivilege 4404 wmic.exe Token: 33 4404 wmic.exe Token: 34 4404 wmic.exe Token: 35 4404 wmic.exe Token: 36 4404 wmic.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1144 MSBuild.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 540 wrote to memory of 3668 540 wscript.exe 86 PID 3668 wrote to memory of 4620 3668 wscript.exe 90 PID 4620 wrote to memory of 1144 4620 powershell.exe 99 PID 4620 wrote to memory of 1144 4620 powershell.exe 99 PID 4620 wrote to memory of 1144 4620 powershell.exe 99 PID 4620 wrote to memory of 1144 4620 powershell.exe 99 PID 1144 wrote to memory of 4404 1144 MSBuild.exe 100 PID 1144 wrote to memory of 3996 1144 MSBuild.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Thư Yêu Cầu Mua HàngF.js"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" //B //NoLogo "C:\Users\Admin\AppData\Local\PrintQueue\ledger92322.js"2⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -File "queue46171.ps1"3⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe4⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:1144 -
C:\Windows\System32\Wbem\wmic.exe"wmic" process where ProcessId=4620 get CommandLine /value5⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
- Loads dropped DLL
PID:3996
-
-
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵PID:3844
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4836
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
- Size 63KB
- SHA256 0232e3d13e53fc069b113190903be389ec59f5991acd99aecc8011d19c2d9282
- MD5 96a644ea4c30cd71c965810ad0bdad55
- SHA1 e748e8bc6cee870b0fb5ea798faa29f0832170f3
- SHA512 7b22ea69c18b7e1f4114fe2368688ebfc9a64803dfe23a2b0d460caf62c27e6f5b00b10752ebf69172eba040b7bcd5580a9fb9bf72025297dc6d47438fd13de0
- SSDEEP 1536:MGLiTh9ZTWZg8FjwYDbCgs7ZodphAQ/m5:MGLiTh9uMYqgsiph9
- TLSH T1FF53C53871C981B7C297CD30586DBF12527330A38FE1669F33ACF61D1E7979A2A1650A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\PrintQueue\ledger92322.js
- Size 780KB
- SHA256 42f0e94c6a4e1d4b05ae29ecb3b67ff7ae3cbcc6002e959b7882a96d49cc2913
- MD5 3891eb8ef4d5eab6765ba6ca17ef3378
- SHA1 5b4b54affbddd1463b07c9fefe68caea8b71aad1
- SHA512 e1d6efb8c0aa3041ddef7c99b78ab00e3de341400db55593323fb4551f4cea72a5b72253b9780f8de5b90a9b9ae9986a55c66ea1c60f98695772def5893afac4
- SSDEEP 12288:5JKFiyTWnpQ3RECXrslPPftH1KfaDpyEM2xL8qfFTFplQ4VCMA/B0v:HKFr2cEmshtHQyU/2xL86p3DPAJe
- TLSH T1DD05E1202539E02F467BC11163AA624C99BD97458619F61E703DD2F24FFB0B522A7FCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\PrintQueue\queue46171.ps1
- Size 416KB
- SHA256 4fa49cbf8dc3d039c3dc076ccc45a2585d4655e1600f11f215527e512a0d64c9
- MD5 743868492b63fb9f07a7e6ebe5fb2f04
- SHA1 b442db441c54e9b2bbd1f368a439739c6d58b8f6
- SHA512 cd32eeb95811b2fe2430252a06e7ddfddf409feeb1270f19e69d3774e4b19a799b601c17fec2556a93ce3ee1091b6d4d449f2539abfc1be8c7257d2eddfa8d90
- SSDEEP 12288:X3XSbEtzGll2wkipkxPlVvTF1A8BONH56LEJV:X3XSQw2wJpitVvTfA80Ht
- TLSH T1AF9423064E368E638DB932AA249D0ECE377C5BDC09C02C9DF7D9BD8D10B6759691322D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4bvjqmzn.vhi.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\.temp\bdeebdd8aba84b22828baac338bd902a.db
- Size 40KB
- SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
- MD5 ba979c77c714b67908bc582ec373c723
- SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
- SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
- SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
- TLSH T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
- MD5 SHA1 SHA512 SSDEEP TLSH