Overview

overview

10

Static

static

1

SGTSTAFF08...30.zip

windows10-2004-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    419s
  • max time network
    405s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    23/10/2026, 18:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SGTSTAFF086LCON_2026-10-23_18_10_43.030.zip
  • Size 5KB
  • Sample261023-wxaefsty4r
  • SHA256 31ded568161d93258827caba67dd4164dd9974733939b90411bda32e72b5f0cb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 4 IoCs
    defense_evasion
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 11 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SGTSTAFF086LCON_2026-10-23_18_10_43.030.zip
    1⤵
      PID:1856
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2324
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\SGTSTAFF086LCON_2026-10-23_18_10_43.030\Files.js"
        1⤵
        • Checks computer location settings
        • Creates a file in the Startup directory
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:1208
        • C:\Windows\System32\wscript.exe
          "C:\Windows\System32\wscript.exe" "C:\Users\Public\Send to.lnk.js"
          2⤵
          • Modifies visibility of hidden/system files in Explorer
          • Badlisted process makes network request
          • Reads the TCP/IP host and domain name from the registry
          PID:3444
      • C:\Windows\System32\wscript.exe
        C:\Windows\System32\wscript.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:436
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\SGTSTAFF086LCON_2026-10-23_18_10_43.030\Files.js"
        1⤵
        • Checks computer location settings
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:4684
        • C:\Windows\System32\wscript.exe
          "C:\Windows\System32\wscript.exe" "C:\Users\Public\Send to.lnk.js"
          2⤵
          • Modifies visibility of hidden/system files in Explorer
          • Badlisted process makes network request
          • Reads the TCP/IP host and domain name from the registry
          PID:4716
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\SGTSTAFF086LCON_2026-10-23_18_10_43.030\Files.js"
        1⤵
        • Checks computer location settings
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\System32\wscript.exe
          "C:\Windows\System32\wscript.exe" "C:\Users\Public\Send to.lnk.js"
          2⤵
          • Modifies visibility of hidden/system files in Explorer
          • Badlisted process makes network request
          • Reads the TCP/IP host and domain name from the registry
          PID:4624
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\SGTSTAFF086LCON_2026-10-23_18_10_43.030\Files.js"
        1⤵
        • Checks computer location settings
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Windows\System32\wscript.exe
          "C:\Windows\System32\wscript.exe" "C:\Users\Public\Send to.lnk.js"
          2⤵
          • Modifies visibility of hidden/system files in Explorer
          • Badlisted process makes network request
          • Reads the TCP/IP host and domain name from the registry
          PID:1448
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SGTSTAFF086LCON_2026-10-23_18_10_43.030\manifest.json
          2⤵
            PID:3304

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Send to.lnk.js
              • Path C:\Users\Public\Send to.lnk.js
              • Size 8KB
              • SHA256 dafc07e963af693bd4feb63f0cfb0958716b94e12e7f93821691377f3b612fac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download