616a435efaa23abf2b388bd9f3d18a07e9b0a9788d23cf9d957809e16e5a947e

Analysis

max time kernel
298s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHIPMENT-PL & CI & BL draft for HF26XF0116A.js
Size 4.6MB
Sample261024-dgbcps11hv
SHA256 616a435efaa23abf2b388bd9f3d18a07e9b0a9788d23cf9d957809e16e5a947e
MD5 c6bf3298102e10d55237cb1c80eedb16
SHA1 23c0db9b82e050fb5a3f9065d75b43d632b19722
SHA512 3581d98d19a6251a9617ac5947c2a5775d4bd6cb811f78d0b15a61a53e411f60e624e5159f7b6aeda6691b9700ee9c69a4ab48c1ae327b45be97858e7c1b73d9
SSDEEP 98304:i5qLfgk0BkHK36nuiiI+SvBtDGt2cRCQjqMUaWcd/ARg+mpS+XiFwvxle94BhuRS:tYDCEjqMN2g+mM+XZLE0n
TLSH
T11126904C136456F14069011DE70DAEAC8F2CF10F732A9929759E2DABBBBC734939BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
3512	JOYBKFUZQUKSUSJR.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4428	cmd.exe
632	cmd.exe
2124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JOYBKFUZQUKSUSJR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\SHIPMENT-PL & CI & BL draft for HF26XF0116A.js:Zone.Identifier	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3512	JOYBKFUZQUKSUSJR.exe
3512	JOYBKFUZQUKSUSJR.exe
3512	JOYBKFUZQUKSUSJR.exe
3512	JOYBKFUZQUKSUSJR.exe
3512	JOYBKFUZQUKSUSJR.exe
3512	JOYBKFUZQUKSUSJR.exe
3512	JOYBKFUZQUKSUSJR.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4428	4504	wscript.exe	84
PID 4504 wrote to memory of 3512	4504	wscript.exe	86
PID 3512 wrote to memory of 632	3512	JOYBKFUZQUKSUSJR.exe	88
PID 632 wrote to memory of 3876	632	cmd.exe	89
PID 3512 wrote to memory of 2124	3512	JOYBKFUZQUKSUSJR.exe	90
PID 2124 wrote to memory of 4508	2124	cmd.exe	91

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\SHIPMENT-PL & CI & BL draft for HF26XF0116A.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\SHIPMENT-PL & CI & BL draft for HF26XF0116A.js:Zone.Identifier"
  2⤵
  - Executes a command shell one-liner
  - NTFS ADS
  PID:4428
- C:\Users\Admin\Documents\JOYBKFUZQUKSUSJR.exe
  "C:\Users\Admin\Documents\JOYBKFUZQUKSUSJR.exe" C:\Users\Admin\Documents\RJSUSKUQZUFKBYOJ
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /query /tn "JOYBKFUZQUKSUSJR" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /query /tn "JOYBKFUZQUKSUSJR"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 10 /tn "JOYBKFUZQUKSUSJR" /tr "wscript.exe \"C:\Users\Admin\Documents\RJSUSKUQZUFKBYOJ.vbs\"" /ru "Admin" /f /it
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 10 /tn "JOYBKFUZQUKSUSJR" /tr "wscript.exe \"C:\Users\Admin\Documents\RJSUSKUQZUFKBYOJ.vbs\"" /ru "Admin" /f /it
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4508

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JOYBKFUZQUKSUSJR.exe

Path C:\Users\Admin\Documents\JOYBKFUZQUKSUSJR.exe
Size 499KB
SHA256 d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49
MD5 7675b38aabebc8427171447edd484b5b
SHA1 145c72f8acdcd366869f955dffd000d3bc146b6e
SHA512 bc9bddbee59f165742a3203f9e2ba9de409e66de6334cb352cded84cce3e1074dbd0ac17b29e58c8729906848b64d1486fb8c848ca15422127b2baeb4c5e5dbe
SSDEEP 12288:HW7YOPcqPqvopYJNWGIbK8AJYlqWuSr7B/Uj:HW7RPcqPqvopYJYK8AyldpUj
TLSH
T176B43AC4BACB08F1E2A355B0C49BDB7F96349A050022D5BAFF5CBD59EC33746092725A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JOYBKFUZQUKSUSJR.mui

Path C:\Users\Admin\Documents\JOYBKFUZQUKSUSJR.mui
Size 2B
SHA256 f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
MD5 98f13708210194c475687be6106a3b84
SHA1 91032ad7bbcb6cf72875e8e8207dcfba80173f7c
SHA512 dfa5d1cefd0efdf5f52b765120da72c5706eb1dd113234cfdf31e31f9cd0283366f6a8f7230f29ea42d83acfe02743dc2504cda07c30f6e84bf9b1ca35966266
MD5 SHA1 SHA512

Submit Download

RJSUSKUQZUFKBYOJ

Path C:\Users\Admin\Documents\RJSUSKUQZUFKBYOJ
Size 709KB
SHA256 3534d60a3888a3a84dec5c08645ad45837cc719eefe3aabd53b8106d702ca241
MD5 3487ac8dd73013c92e48ca9e48b3c3de
SHA1 65da13f322d182f4dab37c579e0bc394b04e21c7
SHA512 bc46f049aa07abdc6b957a2df6bbb81cd83f0c1905c36dea309151e582b799cd3ed0c427f0eab1264db4894c7edc0a6401361886317c012faa70da22ec071b39
SSDEEP 12288:d0PRsqdqld40NXzyt2W7MELJoQSMTCWLGHXNthpXD+w9ucXxgTewVQ6NR1ni03:2mqdqld40Vyt22ZNovAnLGHXNthpXD+Z
TLSH
T194F41B8FB34B295851F762E1CC5B0D9A707594D9435E01274E84E0A0BB2272DDFFAB3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3512-19-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-28-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-12-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-17-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-16-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-18-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-20-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-24-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-23-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-22-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-21-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-11-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-29-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-13-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-27-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-26-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-25-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-30-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-37-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-36-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-35-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-34-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-33-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-32-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-31-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3512-38-0x0000000000CA0000-0x0000000000CE6000-memory.dmp

Download

memory/3512-39-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3512-43-0x0000000000400000-0x0000000000482000-memory.dmp

Download