5be0f14f036d93aa37220edc637071ca868aa1c68ef76e33628e8e368f17304b

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shipment 0000039932200-QA-000390-PDF.jse
Size 43KB
Sample261014-s3ysfse151
SHA256 5be0f14f036d93aa37220edc637071ca868aa1c68ef76e33628e8e368f17304b
MD5 524f7e62a85e78ccf2af30f6f00e40c0
SHA1 8dcd1118400469be935e4bd7ca311819ceb75f5b
SHA512 7068704f90bae4a513d220192e5f0d0c21d2fcca16230088e9489c5d97bfa314cb111aca4bbcbca68735c93901ccc161b605e66f7c7da562f88fa974dc3f93d3
SSDEEP 768:RIXvhvpYWVknxmrHQeWGGWkPJB22fNIWfK8cjm3B2UsYtvMK4NWvZzEl4RfZs9DV:WAwbQkzBhFvR
TLSH
T1EE1342445A92388443B77B3F6B2B98E1E6B7176B0084490BB5BCB480AFF5D1EDDD0879
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\Shipment 0000039932200-QA-000390-PDF.jse"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-0-0x000001A81AF40000-0x000001A81B35E000-memory.dmp

Download