04a4bab8f2c4fd031a26a6b76015f1652621b8321177353ae970ba67b973d2f3

Analysis

max time kernel
6s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HGD87654567800.js
Size 2.0MB
Sample261002-ms17yagf52
SHA256 04a4bab8f2c4fd031a26a6b76015f1652621b8321177353ae970ba67b973d2f3
MD5 ac044ac739fdf70c31a25ad552f660d5
SHA1 05af0f0b54a30f0f2807bf1595e52c570ef2f5ae
SHA512 4e27e351c09528c2e4b2a0f373dc568a0b72aad5eb427d9eabc2353f84e16b763483275fa46e06d4e4d0faac105cad2f4784fabf855453e0de083d52edfbe978
SSDEEP 49152:OV5AU9qNKyzDMLPlgnqi0qxAY/24dRRD7JBaEhCi35HQQNdjT51U3DowHBbthHGH:OV5AU9qNKyzDMLPlgqi02AY/243RD7Jv
TLSH
T13CA573A7CD56413D31E39F482E3A3AB34C429F29C04395D756E45AD4B140FDCB8ACBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4052	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6064	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4052	1272	wscript.exe	88
PID 4052 wrote to memory of 6064	4052	cmd.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\HGD87654567800.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 15 /tn "WindowsSecurityUpdate" /tr "wscript.exe "C:\ProgramData\WindowsSecurityUpdate\WindowsSecurityUpdate.js"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 15 /tn "WindowsSecurityUpdate" /tr "wscript.exe "C:\ProgramData\WindowsSecurityUpdate\WindowsSecurityUpdate.js"" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6064
- C:\ProgramData\App_ix1613ur\support.exe
  "C:\ProgramData\App_ix1613ur\support.exe" "C:\ProgramData\App_ix1613ur\au.dat"
  2⤵
  PID:3908

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.zip

Path C:\ProgramData\App_ix1613ur\app.zip
Size 532KB
SHA256 947f3152455bc2f2fbc18ec68b87f709fb21f29ca63fef39e3b1d43c1c59871f
MD5 cb5943cf9275806283d12e6821f025eb
SHA1 b8276670b151e836c80e07d9a65a69c3864adc80
SHA512 441b51e05842ff4d1d0a31e0698d6ebd8dac8c0b9e763ea92164693128ca78706475bc80d28d561d5a8fc92430564b2ee221f582d6d0718f1a2ea82971ac743b
SSDEEP 12288:h17jChsIcTbJZAvq8xEWCnmld08+2yFluGE8kqc:hdhbudxRemld08FEluGE1x
TLSH
T189C4232315169E6B206C2E9B75729435BCB236589C7F445BD840E24B3B4BA0B334FDBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

au.dat

Path C:\ProgramData\App_ix1613ur\au.dat
Size 1KB
SHA256 5b30788069a293dc8786239d1174041a41dee447bb7ff114cd2fc58963e71b62
MD5 808bd175d8d080bd2ce829310869c780
SHA1 4ca77cedff0cee59d15a356165367f8fc061c2ae
SHA512 5b450744d20b3c850cf5a5bd0c112bc16c798c80b8296598fe0b1c8160d923afe80c5b3c3af8ca13a6c7d8c02d0cee638af24645efe987773d5f63d79be70c21
TLSH
T1D0219CAC2A8B8F57105ED0689513C99BB4608C2C423F1A4A3DF5C764383D27EE9682AD
MD5 SHA1 SHA512 TLSH

Submit Download

au.ini

Path C:\ProgramData\App_ix1613ur\au.ini
Size 90KB
SHA256 acfb728a684849afb6202bbed8a7fd9cfddcb74b11af73f723dcab555eb37fa2
MD5 acb0813cb70b11255b623c88ddce639b
SHA1 8ade51d28ce7aa23b9d3eebac0e4a1e3039358a2
SHA512 d82c9782fa59763e20a0017123630cec6f98536273cdac4d0913f2764bd9669f33db29374500854bb65c52f2c566cf5af9c03aedf908f74d5a222b39975f5aee
SSDEEP 1536:py48/wURSHxG43rrZl3PTlQ4uZqfFTgkg4YSvkzyNXOEhkBnrB288/fJPC:g//Hcf7rZlO4VfmPWMmNXfWw88/tC
TLSH
T15893025537B519BDD9E4FB10DA1137A32F0BA49C5800A57DF418E472B99D3D0F323AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

support.exe

Path C:\ProgramData\App_ix1613ur\support.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3908-58-0x00000250A9E90000-0x00000250A9EA7000-memory.dmp

Download

memory/3908-61-0x00000250A9E90000-0x00000250A9EA7000-memory.dmp

Download

memory/3908-60-0x00000250A9E90000-0x00000250A9EA7000-memory.dmp

Download

memory/3908-59-0x00000250A9E90000-0x00000250A9EA7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads