Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 08:29
General
- Target Invoice – IALOPC342526-279302670s1.js
- Size 735KB
- Sample260930-kdthfasdnh
- SHA256 477f0cb821df28828cf96c798b3b7dc713cc5f982ccd085e1c372d4c08e52491
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Invoice – IALOPC342526-279302670s1.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:UDBZ))2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\122694307958894.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\122694307958894.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:SNYNTGFWLBQU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CVACNIGY))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:SNYNTGFWLBQU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CVACNIGY))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:SNYNTGFWLBQU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CVACNIGY))"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\122694307958894.cmd"3⤵
- Views/modifies file attributes
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
122694307958894.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_hz3acmep.zks.ps1
handoff_dbg_5952_e5931c4.txt
handoff_dbg_5952_e5971fa.txt
handoff_dbg_5952_e5971fa.txt
memory/116-79-0x0000022E73A70000-0x0000022E73A71000-memory.dmp
memory/116-46-0x0000000180000000-0x0000000180040000-memory.dmp
memory/116-58-0x0000022E73670000-0x0000022E736B0000-memory.dmp
memory/116-74-0x0000022E739E0000-0x0000022E739E1000-memory.dmp
memory/116-43-0x0000022E73670000-0x0000022E736B0000-memory.dmp
memory/116-77-0x0000000140000000-0x0000000140050000-memory.dmp
memory/116-83-0x00007FF6A0C70000-0x00007FF6A0C7D000-memory.dmp
memory/116-42-0x0000022E73670000-0x0000022E736B0000-memory.dmp
memory/116-62-0x0000000140000000-0x0000000140050000-memory.dmp
memory/1492-0-0x0000011CFACC0000-0x0000011CFACD0000-memory.dmp
memory/1492-2-0x0000011CFAC50000-0x0000011CFAC72000-memory.dmp
memory/1492-1-0x0000011CFACC0000-0x0000011CFACD0000-memory.dmp
memory/1524-86-0x0000021D71E80000-0x0000021D71EC0000-memory.dmp
memory/1524-101-0x0000021D71E80000-0x0000021D71EC0000-memory.dmp
memory/1524-89-0x0000000180000000-0x0000000180040000-memory.dmp
memory/1524-85-0x0000021D71E80000-0x0000021D71EC0000-memory.dmp
memory/1524-126-0x00007FF6A0C70000-0x00007FF6A0C7D000-memory.dmp