7b4fe6b40a5d1f440382458458c91087c1581d82d80a82550917ef4f88c8ec6a

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Samples.js
Size 53KB
Sample261009-sd4bmsytaw
SHA256 7b4fe6b40a5d1f440382458458c91087c1581d82d80a82550917ef4f88c8ec6a
MD5 eeb8ca43b094a3caca42a1d2493d6369
SHA1 b76fc3710476cec22551ac1dde85e89115484b8c
SHA512 7977d2db916a0505ea40ec034eeff30310d82c980632745dc14c3c30957c8fe12d3bd06019868b4d99d60edc65386f3959025d997304b84ddf8d5f80b01239a2
SSDEEP 768:LF8Yc6bNu5EoOb5LBM3Pe024hBZXNVnnZ3SHzttu+mT1Y4y76U7EdhgO4:580bNuxPewjRSmTE7T
TLSH
T13F33C84A834222FCE62057838D29909E8CF987DE055C58FC664AD7DFFB2CD9C5365B28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	5716	cmd.exe	89

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4456	powershell.exe
8	4456	powershell.exe
9	4456	powershell.exe
10	4456	powershell.exe
11	4456	powershell.exe
12	4456	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5004	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4456 set thread context of 3416	4456	powershell.exe	102

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2980	cmd.exe
3768	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5384	taskkill.exe
1036	taskkill.exe
4312	taskkill.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4456	powershell.exe
4456	powershell.exe
5004	powershell.exe
5004	powershell.exe
3416	Msbuild.exe
3416	Msbuild.exe
4456	powershell.exe
3416	Msbuild.exe
3416	Msbuild.exe
3416	Msbuild.exe
3416	Msbuild.exe
3416	Msbuild.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	5384	taskkill.exe
Token: SeDebugPrivilege	1036	taskkill.exe
Token: SeDebugPrivilege	4312	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 4456	2980	cmd.exe	92
PID 4456 wrote to memory of 2096	4456	powershell.exe	93
PID 2096 wrote to memory of 2664	2096	csc.exe	94
PID 4456 wrote to memory of 5004	4456	powershell.exe	95
PID 5004 wrote to memory of 3768	5004	powershell.exe	97
PID 3768 wrote to memory of 5384	3768	cmd.exe	99
PID 3768 wrote to memory of 1036	3768	cmd.exe	100
PID 3768 wrote to memory of 4312	3768	cmd.exe	101
PID 4456 wrote to memory of 3416	4456	powershell.exe	102
PID 4456 wrote to memory of 3416	4456	powershell.exe	102
PID 4456 wrote to memory of 3416	4456	powershell.exe	102

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\New Samples.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:3872

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe .(${env:ProgramFiles(x86)}[12,14,18]-join'') $env:SjrdiAkkz;
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .(${env:ProgramFiles(x86)}[12,14,18]-join'') $env:SjrdiAkkz;
  2⤵
  - Badlisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ejon14id\ejon14id.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4ED2.tmp" "c:\Users\Admin\AppData\Local\Temp\ejon14id\CSC3D115116C2C84A53B47C7B47765BECCC.TMP"
      4⤵
      PID:2664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5384
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1036
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6d1ed721619019a4cc7c596ac7e81376fc791021e3aebc186da1d99169467b31
MD5 65324bd38d7c399f17d540a6a2ac14a8
SHA1 0da28ef583350096f9d66575798a40e2e4582862
SHA512 7028122e36bd7918028486b473e37ca5a34b37fc22d36184529760af369264b5cbbf41492469cd4ea9a306d47fb84a805934da78611a861ea7baf3d33deed367
TLSH
T10A214833F3DC8615D889407A50CEAC1436B697EB80DECF6BBB84D648B43F599CE60660
MD5 SHA1 SHA512 TLSH

Submit Download

RES4ED2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4ED2.tmp
Size 1KB
SHA256 86b2908cb9a4448b16b9fc56fe98545a9ce65286fbd73c8e7aac4d04b73c808a
MD5 456d43b881946dd1f76be0d2ca805007
SHA1 054c5325451c2a02e0972e4bbaa3bd1d4495e9b4
SHA512 8a7a713a90a687b1b90fc8b483eb9837130eb6fdbe6a55e23b4bcce1f53dac4ab09c961555396459834014f206a753dd403ac894285e9d5f5659a1c6092196b6
TLSH
T1DC21890543ED471BF0B357316AFA072BA674FD65EF65939A848442692C41504EEA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cph1c544.00e.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cph1c544.00e.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ejon14id.dll

Path C:\Users\Admin\AppData\Local\Temp\ejon14id\ejon14id.dll
Size 3KB
SHA256 d700590bb6c997e4d14b654b1d8fce18e1d3bf48e040b484b7dbb5afc60e66f4
MD5 568f28ecebf77d1089e271c9cac29425
SHA1 26dd9214b7f4bdbb67262b0f23fc103d6d89c88c
SHA512 9e933a5dc2999bcbb99dc8a1979c01b4b80f8d762ab1b75e4c291b659d2cffb091552174392ff9ade124bfac46c2b60c105469c527afccb5bdb6283b8b4664c7
TLSH
T1B951001563E8477BE4B70B347EF787572674F9109B62535E198002286C613606E32BB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3D115116C2C84A53B47C7B47765BECCC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ejon14id\CSC3D115116C2C84A53B47C7B47765BECCC.TMP
Size 652B
SHA256 f26725c0020572aba17bc818580e8e9c4cb105281a6497399135194e781146a7
MD5 da98a2154d2621b6bb2d2ae26d4374bb
SHA1 45341dc5290d652b36add25390997abf33f3b78f
SHA512 d6f6f69b7d41be021c572fe86f0a9ee2955c4181a9d9bdbbfddc0f3d7325dd5d853a9cdb9c03962acd173f41703d158947091d7e17593ce5bbccc8050535b60a
TLSH
T1C4F03A0963F8520AF0F34B30BAF6436395A8FC64DE3293ED1490031A2C646109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ejon14id.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ejon14id\ejon14id.0.cs
Size 216B
SHA256 9a6272e0393665959f3b8e2224390e3eeca83e69f07bb3fd389e42372fc8f5c1
MD5 4340ba990fb9aca3db6a7bbf940d8466
SHA1 929616452802dd25e154dcd83ed5645ea6f51187
SHA512 5cdd1b61f1ffa07cea1699261027db3d89b92ed4ce8da24afff52704ff66feda1bc018220c323f2af7a602951e0a0662210d50391ef3ed990194a77a5d2d6c0c
TLSH
T164D0A9803692F3384B9309073C03B89A223FA71103EA6408E8690D43EE081B0BB38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

ejon14id.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ejon14id\ejon14id.cmdline
Size 369B
SHA256 1c3bae80aecb8711d584ce6a3cd4faa4b915930f09061a3703045c674759c020
MD5 1b0c46040cc41d1ad8003fae4a6e1de0
SHA1 098d05de92e4ef4dd2a09f8f890f0a5392291258
SHA512 61305152d674b412a94b147b72106a44f3c9aa8a066198525b65d44480b8a638f26036c84745424aa58654fe702e24f7e7113ec9e5b7aa85ad071ffd41f002da
TLSH
T1FFE0C06A426AC67D11ED110735AAC4ECC67207432D407FD858EC440DD6170083BD1752
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3416-39-0x0000000000040000-0x000000000008C000-memory.dmp

Download

memory/4456-9-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-30-0x000001F4D5240000-0x000001F4D5254000-memory.dmp

Download

memory/4456-13-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-14-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-15-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-11-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-10-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-0-0x00007FFF40EBF000-0x00007FFF40EC0000-memory.dmp

Download

memory/4456-8-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-28-0x000001F4D5380000-0x000001F4D5388000-memory.dmp

Download

memory/4456-7-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-12-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-31-0x000001F4D5250000-0x000001F4D5258000-memory.dmp

Download

memory/4456-6-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-5-0x000001F4D5540000-0x000001F4D5562000-memory.dmp

Download

memory/4456-35-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-36-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-37-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-40-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-4-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-3-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4456-44-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download