Analysis
- max time kernel
2s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/10/2026, 21:45
General
- Target Price offer RequestQ202600021.js
- Size 3.0MB
- Sample261022-1mappaxz5p
- SHA256 46e7e61e0f518b191b94cfab6ef0c162209fda278615a22640701072cce545f9
Malware Config
Signatures
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Price offer RequestQ202600021.js"1⤵
- Registers new Windows logon scripts automatically executed at logon.
-
C:\ProgramData\XIYEJRTMPWNRXCNAK\XIYEJRTMPWNRXCNAK.exe"C:\ProgramData\XIYEJRTMPWNRXCNAK\XIYEJRTMPWNRXCNAK.exe" -run "C:\ProgramData\XIYEJRTMPWNRXCNAK\XIYEJRTMPWNRXCNAK.C"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
XIYEJRTMPWNRXCNAK.C
XIYEJRTMPWNRXCNAK.exe
XIYEJRTMPWNRXCNAK.zip
libtcc.dll
_mingw.h
ctype.h
excpt.h
limits.h
malloc.h
stdio_s.h
stdlib_s.h
string_s.h
stdarg.h
stddef.h
stdio.h
stdlib.h
string.h
vadefs.h
basetsd.h
guiddef.h
poppack.h
pshpack1.h
pshpack2.h
pshpack4.h
pshpack8.h
winbase.h
wincon.h
windef.h
windows.h
winerror.h
wingdi.h
winnt.h
winreg.h
winuser.h
winver.h
kernel32.def
libtcc1-64.a
msvcrt.def
user32.def
memory/2660-2003-0x0000000000610000-0x0000000000667000-memory.dmp
memory/2660-2006-0x0000000000610000-0x0000000000667000-memory.dmp
memory/2660-2005-0x0000000000610000-0x0000000000667000-memory.dmp
memory/2660-2004-0x0000000000610000-0x0000000000667000-memory.dmp
memory/2660-10600-0x0000000062180000-0x00000000621D2000-memory.dmp
memory/2660-10599-0x0000000000400000-0x000000000040B000-memory.dmp