477f0cb821df28828cf96c798b3b7dc713cc5f982ccd085e1c372d4c08e52491

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice – IALOPC342526-279302670s1.js
Size 735KB
Sample260930-kdthfasdnh
SHA256 477f0cb821df28828cf96c798b3b7dc713cc5f982ccd085e1c372d4c08e52491
MD5 6f65c1b2be568af7d9966c0d592e069a
SHA1 61af89fc1f0710321e4aaa0d41cadb7e59ae4db9
SHA512 a3f2e737667234421dde3a891e6acf10709b8b2a8cb29c360ef34b160235b47f7c1489529b0cb2cc0ec7bb0d82cc15d9ab8f86e5c3cddbb72c35faebe2ab09f5
SSDEEP 12288:ki8piR0wAXh7W/NsxSNlIB1PCBNOWXXJ6q7xqIZBaKlgRTx6rHUg5OgMi6h8PKz2:kqR0th0NsUcPwPo+xt7e5kUDxiHPKz5I
TLSH
T14CF4E00952479A2035D8EB0E5BCFCA2526B9B781D70AD9C6FC0CC3D16B6B27181F5E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\HidMapRefresh_BTDE = "C:\\Windows\\System32\\conhost.exe --headless -- C:\\Windows\\System32\\cmd.exe /c call \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\edb_tmp\\edb_tmp_WLZVSUWAh.cmd\""	powershell.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4964	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1868	powershell.exe
4060	powershell.exe
3712	powershell.exe
3648	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1868	powershell.exe
1868	powershell.exe
4060	powershell.exe
4060	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
4296	choice.exe
4296	choice.exe
3648	powershell.exe
2064	choice.exe
2064	choice.exe

Suspicious behavior: MapViewOfSection 1 TTPs 4 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeIncreaseQuotaPrivilege	3648	powershell.exe
Token: SeSecurityPrivilege	3648	powershell.exe
Token: SeTakeOwnershipPrivilege	3648	powershell.exe
Token: SeLoadDriverPrivilege	3648	powershell.exe
Token: SeSystemProfilePrivilege	3648	powershell.exe
Token: SeSystemtimePrivilege	3648	powershell.exe
Token: SeProfSingleProcessPrivilege	3648	powershell.exe
Token: SeIncBasePriorityPrivilege	3648	powershell.exe
Token: SeCreatePagefilePrivilege	3648	powershell.exe
Token: SeBackupPrivilege	3648	powershell.exe
Token: SeRestorePrivilege	3648	powershell.exe
Token: SeShutdownPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeSystemEnvironmentPrivilege	3648	powershell.exe
Token: SeRemoteShutdownPrivilege	3648	powershell.exe
Token: SeUndockPrivilege	3648	powershell.exe
Token: SeManageVolumePrivilege	3648	powershell.exe
Token: 33	3648	powershell.exe
Token: 34	3648	powershell.exe
Token: 35	3648	powershell.exe
Token: 36	3648	powershell.exe
Token: SeIncreaseQuotaPrivilege	3648	powershell.exe
Token: SeSecurityPrivilege	3648	powershell.exe
Token: SeTakeOwnershipPrivilege	3648	powershell.exe
Token: SeLoadDriverPrivilege	3648	powershell.exe
Token: SeSystemProfilePrivilege	3648	powershell.exe
Token: SeSystemtimePrivilege	3648	powershell.exe
Token: SeProfSingleProcessPrivilege	3648	powershell.exe
Token: SeIncBasePriorityPrivilege	3648	powershell.exe
Token: SeCreatePagefilePrivilege	3648	powershell.exe
Token: SeBackupPrivilege	3648	powershell.exe
Token: SeRestorePrivilege	3648	powershell.exe
Token: SeShutdownPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeSystemEnvironmentPrivilege	3648	powershell.exe
Token: SeRemoteShutdownPrivilege	3648	powershell.exe
Token: SeUndockPrivilege	3648	powershell.exe
Token: SeManageVolumePrivilege	3648	powershell.exe
Token: 33	3648	powershell.exe
Token: 34	3648	powershell.exe
Token: 35	3648	powershell.exe
Token: 36	3648	powershell.exe
Token: SeIncreaseQuotaPrivilege	3648	powershell.exe
Token: SeSecurityPrivilege	3648	powershell.exe
Token: SeTakeOwnershipPrivilege	3648	powershell.exe
Token: SeLoadDriverPrivilege	3648	powershell.exe
Token: SeSystemProfilePrivilege	3648	powershell.exe
Token: SeSystemtimePrivilege	3648	powershell.exe
Token: SeProfSingleProcessPrivilege	3648	powershell.exe
Token: SeIncBasePriorityPrivilege	3648	powershell.exe
Token: SeCreatePagefilePrivilege	3648	powershell.exe
Token: SeBackupPrivilege	3648	powershell.exe
Token: SeRestorePrivilege	3648	powershell.exe
Token: SeShutdownPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeSystemEnvironmentPrivilege	3648	powershell.exe
Token: SeRemoteShutdownPrivilege	3648	powershell.exe
Token: SeUndockPrivilege	3648	powershell.exe
Token: SeManageVolumePrivilege	3648	powershell.exe
Token: 33	3648	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1868	5096	wscript.exe	88
PID 5096 wrote to memory of 4964	5096	wscript.exe	90
PID 4964 wrote to memory of 4060	4964	cmd.exe	92
PID 4964 wrote to memory of 3712	4964	cmd.exe	93
PID 3712 wrote to memory of 3648	3712	powershell.exe	94
PID 4964 wrote to memory of 4476	4964	cmd.exe	96
PID 3648 wrote to memory of 4296	3648	powershell.exe	98
PID 3648 wrote to memory of 2064	3648	powershell.exe	100

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4476	attrib.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Invoice – IALOPC342526-279302670s1.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:UDBZ))
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1868
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\122694307958894.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\122694307958894.cmd"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:SNYNTGFWLBQU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CVACNIGY))"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:SNYNTGFWLBQU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CVACNIGY))"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:SNYNTGFWLBQU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CVACNIGY))"
      4⤵
      Adds Run key to start application
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3648
    - - C:\Windows\system32\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4296
    - - C:\Windows\system32\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2064
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\122694307958894.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

122694307958894.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\122694307958894.cmd
Size 698KB
SHA256 af2d3b73508173d0b0f3dd7f2dd6f314ee93323ff8b8171bcf36f6d72da20c71
MD5 a659d962a615be30c526b6be208914e9
SHA1 96da0e81eb1d3187593ad111a26ab9fac192d1fe
SHA512 0501ed55bc2c056daaa766aae7402cafa96f63ccde6a8c7d4956a60129193695b876d54986737bc67472c9aa4839217029dc45444a12a7196e8b812639c698a2
SSDEEP 12288:Wi8piR0wAXh7W/NsxSNlIB1PCBNOWXXJ6q7xqIZBaKlgRTx6rHUg5OgMi6h8PKzk:WqR0th0NsUcPwPo+xt7e5kUDxiHPKzk
TLSH
T13FE4020AE757AB743AA1F20F92C98D1A19A25BC20B47DCCBFC4D01D368BD376167A41D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 807eba66edd224f8505f7abf88c8b23401e9ef3ddc8447604880fe60e4345d03
MD5 2f4740f7fef04e41ddf9efa031fb7a77
SHA1 367b2b6a4f04334b9f7aee4bbeeb3010f4910d83
SHA512 cafbf283f311d4b1254b8ee584fa53ec968b4e5d080e6f541918d825bef35cb396a4b540ac4766270fb5145179089871a0132c6a7fd2afc76cc7999d70d82ad9
TLSH
T1BF112633F3CD8624DC59803650DEAD1136B687CB40DECE6B7B84D155B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fa606866043197f75de4426de51670f2291a94433384efe403e0026db4429a69
MD5 18a431e2bf1c7189baadfb9c408f62eb
SHA1 fc8e72f7c9ebcd482cc8d2c04b8bc8f606123c2d
SHA512 92552b76e6c27c94d721cd140e671db8bd23fbfc1085e099225c52eb8279a4ba90325ec9406f077c13a187e296745d880aec5c42e4b894b7dddf6d64aced536a
TLSH
T175218933B3DC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lyvxlevq.5gs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lyvxlevq.5gs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_3648_e5a63dc.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_3648_e5a63dc.txt
Size 553B
SHA256 0a1401f7a090a6e6923cfe6a2fdb8ecbf5a8ad25df57308e380a2e50d314c2eb
MD5 d1c25f287d88d1f1ea8ea532ecea76a9
SHA1 3169eb788086bffcb7e3daab2ef58f35e5d214fd
SHA512 03fe0eca79e548766ed907680e8c887ff280b39525cb872dd6bedad763b797bdfd066acac6dea61c55445aa9da7ef64d0642000fbcc578c63544c33851faa90c
TLSH
T1B6F0327C88D848CBFCC12909FA07BAA636A1B003B3D6C82F77DC232470899326B08575
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_3648_e5a9f00.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_3648_e5a9f00.txt
Size 553B
SHA256 b046aa0142a7ee3653669d880c6b88ce415af87ccccd645808c1eff06240a4f2
MD5 2c9f73701a9d06a74170cbabb03aa6de
SHA1 f006a998d3c4623b3f5a1c3164448249861fa067
SHA512 7b22977fba3ecd3064dddd4e2846b595ab933b6d4ab2e1292046ec6089198fe60dd0d492239d9c23fd0aa0417eb0c2aeae6b35399a35417eb129494b444722df
TLSH
T1AFF01E3C88D848CBFDC12909FA07BAA636A1B003B3D6C81F77DC232470999366B08534
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1868-16-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-5-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-10-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-11-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-13-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-14-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-8-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-7-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-6-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-9-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-4-0x00007FF9AD410000-0x00007FF9ADDB4000-memory.dmp

Download

memory/1868-0-0x00007FF9AD59F000-0x00007FF9AD5A0000-memory.dmp

Download

memory/1868-3-0x0000021465200000-0x0000021465222000-memory.dmp

Download

memory/2064-93-0x0000000180000000-0x0000000180040000-memory.dmp

Download

memory/2064-131-0x00007FF691250000-0x00007FF69125E000-memory.dmp

Download

memory/2064-105-0x000002C9EB670000-0x000002C9EB6B0000-memory.dmp

Download

memory/2064-89-0x000002C9EB670000-0x000002C9EB6B0000-memory.dmp

Download

memory/2064-88-0x000002C9EB670000-0x000002C9EB6B0000-memory.dmp

Download

memory/3648-36-0x000001ED68760000-0x000001ED6877E000-memory.dmp

Download

memory/3648-39-0x000001ED68400000-0x000001ED68408000-memory.dmp

Download

memory/3648-33-0x000001ED68860000-0x000001ED6887E000-memory.dmp

Download

memory/3648-34-0x000001ED68880000-0x000001ED68932000-memory.dmp

Download

memory/3648-40-0x000001ED68730000-0x000001ED68736000-memory.dmp

Download

memory/3648-41-0x000001ED68740000-0x000001ED6874A000-memory.dmp

Download

memory/3648-35-0x000001ED689E0000-0x000001ED689EA000-memory.dmp

Download

memory/3648-37-0x000001ED683F0000-0x000001ED683FA000-memory.dmp

Download

memory/3648-38-0x000001ED68780000-0x000001ED6879C000-memory.dmp

Download

memory/4296-75-0x000001A4C0E80000-0x000001A4C0E81000-memory.dmp

Download

memory/4296-81-0x000001A4C26C0000-0x000001A4C26C1000-memory.dmp

Download

memory/4296-85-0x00007FF691250000-0x00007FF69125E000-memory.dmp

Download

memory/4296-58-0x000001A4C0D40000-0x000001A4C0D80000-memory.dmp

Download

memory/4296-47-0x0000000180000000-0x0000000180040000-memory.dmp

Download

memory/4296-63-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4296-65-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4296-43-0x000001A4C0D40000-0x000001A4C0D80000-memory.dmp

Download

memory/4296-42-0x000001A4C0D40000-0x000001A4C0D80000-memory.dmp

Download