Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 07:56
General
- Target 가격 문의 #39.pdf.js
- Size 2.7MB
- Sample261006-jsxyqstdra
- SHA256 aeef3d551617a807c91b70304273060a06d1fcf6d30ee2b4996bccbfe0342640
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\가격 문의 #39.pdf.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_TsNBqhxoZXMm_1791273393392.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ps_TsNBqhxoZXMm_1791273393392.ps1
memory/5052-19-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-21-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-7-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-6-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-8-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-5-0x000001AC7FFC0000-0x000001AC7FFE2000-memory.dmp
memory/5052-9-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-12-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-20-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-11-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-14-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-15-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-16-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-17-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-4-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-18-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-13-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-1-0x00007FF8DFC0F000-0x00007FF8DFC10000-memory.dmp
memory/5052-22-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-24-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-23-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-25-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-27-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-28-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-29-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-26-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-30-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-32-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-31-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-33-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-34-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/5052-36-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp