7b4fe6b40a5d1f440382458458c91087c1581d82d80a82550917ef4f88c8ec6a

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Samples.js
Size 53KB
Sample261009-sd4bmsytaw
SHA256 7b4fe6b40a5d1f440382458458c91087c1581d82d80a82550917ef4f88c8ec6a
MD5 eeb8ca43b094a3caca42a1d2493d6369
SHA1 b76fc3710476cec22551ac1dde85e89115484b8c
SHA512 7977d2db916a0505ea40ec034eeff30310d82c980632745dc14c3c30957c8fe12d3bd06019868b4d99d60edc65386f3959025d997304b84ddf8d5f80b01239a2
SSDEEP 768:LF8Yc6bNu5EoOb5LBM3Pe024hBZXNVnnZ3SHzttu+mT1Y4y76U7EdhgO4:580bNuxPewjRSmTE7T
TLSH
T13F33C84A834222FCE62057838D29909E8CF987DE055C58FC664AD7DFFB2CD9C5365B28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	4632	cmd.exe	85

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2160	powershell.exe
20	2160	powershell.exe
21	2160	powershell.exe
22	2160	powershell.exe
29	2160	powershell.exe
30	2160	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4204	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 1300	2160	powershell.exe	109

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4732	cmd.exe
1968	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4616	taskkill.exe
680	taskkill.exe
5096	taskkill.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2160	powershell.exe
2160	powershell.exe
4204	powershell.exe
4204	powershell.exe
4204	powershell.exe
2160	powershell.exe
1300	Msbuild.exe
1300	Msbuild.exe
1300	Msbuild.exe
1300	Msbuild.exe
1300	Msbuild.exe
1300	Msbuild.exe
1300	Msbuild.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	4616	taskkill.exe
Token: SeDebugPrivilege	680	taskkill.exe
Token: SeDebugPrivilege	5096	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2160	4732	cmd.exe	88
PID 2160 wrote to memory of 204	2160	powershell.exe	95
PID 204 wrote to memory of 2944	204	csc.exe	96
PID 2160 wrote to memory of 4204	2160	powershell.exe	102
PID 4204 wrote to memory of 1968	4204	powershell.exe	104
PID 1968 wrote to memory of 4616	1968	cmd.exe	106
PID 1968 wrote to memory of 680	1968	cmd.exe	107
PID 1968 wrote to memory of 5096	1968	cmd.exe	108
PID 2160 wrote to memory of 1300	2160	powershell.exe	109
PID 2160 wrote to memory of 1300	2160	powershell.exe	109
PID 2160 wrote to memory of 1300	2160	powershell.exe	109

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\New Samples.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:4720

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe .(${env:ProgramFiles(x86)}[12,14,18]-join'') $env:SjrdiAkkz;
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .(${env:ProgramFiles(x86)}[12,14,18]-join'') $env:SjrdiAkkz;
  2⤵
  - Badlisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r0zv4tvu\r0zv4tvu.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE162.tmp" "c:\Users\Admin\AppData\Local\Temp\r0zv4tvu\CSC33C50002F5A44E51BD21EE249F9EEEE2.TMP"
      4⤵
      PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4734c2689908b68466a6d8251cd583c060a43f616d88b225ebd384c5c2a24a3a
MD5 dfcd8072e963c1bf2340b12ff7d12f47
SHA1 b351d00ee25d9deefb716644e321e8265161729b
SHA512 c0c067a368dc15a5c2c0cd8d369bd275481d3cafe1c3bca743a04092db0fc7ef1c78e8187415f5b20fa2500d65c4b9545144e953515b03f783d36f15cf7bd4ab
TLSH
T174217523F39C8921CC8A013A109E9C0076B683D7419ECF9FAFC4D608E17F898CB62590
MD5 SHA1 SHA512 TLSH

Submit Download

RESE162.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE162.tmp
Size 1KB
SHA256 2165a1e03865485527c90c79401bb156b3a73537a8313601271f0902d8206c11
MD5 1d2d53cf415c9bdfce755d5e5a539f77
SHA1 2f9982bfcd413b1333257ca178b0c289dd41d617
SHA512 9908ecf2839cc5c558c8a6ee41171505ca00422e1c2a4f11fd3d8acec7a0ad270d055b4b840ae81012e741485293e92de38f858793cb37ea42a535d45e12dd08
TLSH
T11121590583E9471AF0B35B3169F6172BA629FD96EF62976B858402282C51504EEE0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2dg4xkrd.3an.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2dg4xkrd.3an.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

r0zv4tvu.dll

Path C:\Users\Admin\AppData\Local\Temp\r0zv4tvu\r0zv4tvu.dll
Size 3KB
SHA256 909bc1d0ebc4109336052104d0cfe19a643197fc99e4f20dee872198b277e8a4
MD5 9fef624a20666af4d3fe693c7aaa5773
SHA1 07b8078476739326e0b065decc19d3f77931f0cd
SHA512 027fef16fe83ca29245fc092964fe44b23e71d01b044715ef697d3fc5263cc1a35a793798d107bcb0af39eb8bbd04fc30edccf046eb118eb87414880ea07a18c
TLSH
T11851C91663E8462BF4B70B347EF383473378F9119B62931D59800228AC313606E22FBA
MD5 SHA1 SHA512 TLSH

Submit Download

CSC33C50002F5A44E51BD21EE249F9EEEE2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\r0zv4tvu\CSC33C50002F5A44E51BD21EE249F9EEEE2.TMP
Size 652B
SHA256 a93c473f65f7139e17d7f848451200061ba036f11e91c8d69597b88d9b5c4953
MD5 7f673dcf2f2803acd9408db731ef3e94
SHA1 285a39ae20371c21f46c6435044d41e84726c9f4
SHA512 e72eb07e41e4b395c404cb78c090fbf2f39414f9e5185eb9ff51f36eb740cd0b7269db260e42da92bc1abfab5df35bdd0a18111835fd7284dd79c1165ccf2875
TLSH
T162F05E0963F8020EF0F35B70BDF6836395A9BCA6DE3293ED1554031D686451089A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

r0zv4tvu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\r0zv4tvu\r0zv4tvu.0.cs
Size 216B
SHA256 9a6272e0393665959f3b8e2224390e3eeca83e69f07bb3fd389e42372fc8f5c1
MD5 4340ba990fb9aca3db6a7bbf940d8466
SHA1 929616452802dd25e154dcd83ed5645ea6f51187
SHA512 5cdd1b61f1ffa07cea1699261027db3d89b92ed4ce8da24afff52704ff66feda1bc018220c323f2af7a602951e0a0662210d50391ef3ed990194a77a5d2d6c0c
TLSH
T164D0A9803692F3384B9309073C03B89A223FA71103EA6408E8690D43EE081B0BB38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

r0zv4tvu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\r0zv4tvu\r0zv4tvu.cmdline
Size 369B
SHA256 79764b5e5475e980eade4c7b7e7af1ba2286557861169f7995234c3fc049fc7a
MD5 dc408219a0d19486cb0724f0193a276f
SHA1 e6b52c980ccd80aa8ebb07b8d473913d7d8efd34
SHA512 a41c0be225f78cc150f0216a4fec8852984957b6dff77c57260d2faf8c4bde7301fb89cc6a6aada2d43768d4b49da4c2a77a281814391793587a9b20d53eeab4
TLSH
T1EDE0682A4346C27D11D91047216BE4ADB2720A432942BF8856C8880DF07780027D27C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1300-39-0x0000000000040000-0x000000000008C000-memory.dmp

Download

memory/2160-23-0x00000213ECF80000-0x00000213ECF88000-memory.dmp

Download

memory/2160-0-0x00000213ECF90000-0x00000213ECFA0000-memory.dmp

Download

memory/2160-24-0x00000213ECF90000-0x00000213ECFA0000-memory.dmp

Download

memory/2160-25-0x00000213EC970000-0x00000213EC984000-memory.dmp

Download

memory/2160-26-0x00000213EC980000-0x00000213EC988000-memory.dmp

Download

memory/2160-34-0x00000213EF3E0000-0x00000213EF52E000-memory.dmp

Download

memory/2160-35-0x00000213ECF90000-0x00000213ECFA0000-memory.dmp

Download

memory/2160-10-0x00000213ECF90000-0x00000213ECFA0000-memory.dmp

Download

memory/2160-4-0x00000213EF0B0000-0x00000213EF0D2000-memory.dmp

Download

memory/2160-44-0x00000213EF3E0000-0x00000213EF52E000-memory.dmp

Download

memory/2160-1-0x00000213ECF90000-0x00000213ECFA0000-memory.dmp

Download

memory/4204-38-0x000001EF54A50000-0x000001EF54B9E000-memory.dmp

Download