Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/10/2026, 15:00
General
- Target Orden de compra_93938387.js
- Size 285KB
- Sample261009-sdkjjay16q
- SHA256 1169f4fe3eea997dfd820ef78c1bb0acea3398fb3bd062beac21d3882691f9b0
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Orden de compra_93938387.js"1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoPr -NonI -WindowStyle Hidden -C "[scriptblock]::Create([IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\69143.ps1')).Invoke()"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_yajrnqlg.hqz.ps1
memory/4508-8-0x00000000061A0000-0x0000000006206000-memory.dmp
memory/4508-4-0x0000000005A50000-0x000000000609A000-memory.dmp
memory/4508-3-0x0000000074750000-0x0000000074F0C000-memory.dmp
memory/4508-5-0x0000000074750000-0x0000000074F0C000-memory.dmp
memory/4508-6-0x00000000058D0000-0x00000000058F2000-memory.dmp
memory/4508-1-0x0000000074762000-0x0000000074763000-memory.dmp
memory/4508-7-0x0000000005970000-0x00000000059D6000-memory.dmp
memory/4508-2-0x00000000032B0000-0x00000000032E6000-memory.dmp
memory/4508-14-0x0000000006290000-0x00000000065EB000-memory.dmp
memory/4508-16-0x00000000067C0000-0x00000000067DE000-memory.dmp
memory/4508-17-0x0000000006800000-0x000000000684C000-memory.dmp
memory/4508-19-0x0000000074750000-0x0000000074F0C000-memory.dmp