31ded568161d93258827caba67dd4164dd9974733939b90411bda32e72b5f0cb

Analysis

user interaction
yes
max time kernel
1620s
max time network
1460s
platform
windows11-21h2_x64
resource
win11-20260911-es
resource tags

arch:x64arch:x86image:win11-20260911-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SGTSTAFF086LCON_2026-10-23_18_10_43.030.zip
Size 5KB
Sample261024-sd87wsav9x
SHA256 31ded568161d93258827caba67dd4164dd9974733939b90411bda32e72b5f0cb
MD5 a15a6814639997cfb2a581143e637de5
SHA1 19da21a24ea12ce0747c1b89f48362e2351d5bbd
SHA512 24945d6354ece45dd53bdf8cc7e496d41759a8e977934c5a72585035a6e647c62589d8518e9c542c101483493ad7211ef6acae00de8195b663b45e8704a4838d
SSDEEP 96:y0HPhJjDFGFt6hy+GolcPOPQzn0ys19yKMbxPNvbdLrRF78kvolKefAqa2Pz5TVo:TJZD4FtIyH4cPOYznm9qbxPVdLrn8wew
TLSH
T1A5C19E11A316D8C4E42009F2A9D76F0136F033D299908366562D9BBE7CC616B3FB161B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wscript.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3224	wscript.exe
37	3224	wscript.exe
39	3224	wscript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to.lnk	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3024	LocalBridge.exe
3024	LocalBridge.exe
3024	LocalBridge.exe
3024	LocalBridge.exe
3024	LocalBridge.exe
3024	LocalBridge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5228	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 3224	3860	WScript.exe	89

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SGTSTAFF086LCON_2026-10-23_18_10_43.030.zip
1⤵
PID:3508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4664

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\SGTSTAFF086LCON_2026-10-23_18_10_43.030\Files.js"
1⤵
- Creates a file in the Startup directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Public\Send to.lnk.js"
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  - Badlisted process makes network request
  - Reads the TCP/IP host and domain name from the registry
  PID:3224

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:568

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5228

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 20KB
SHA256 3459e87136e337ff39e1d3391d418571dd60255f923c3d80f608700d2766a37a
MD5 715e91e3d6f3911a50d585f868fdf6f4
SHA1 0759d7c422501917432cd32159410e2fc1e2e333
SHA512 a52500304952c7d8e0929c9b85745c4151a9eda810d6d5516a882881ee1d7dcaf3d69cae0bbd5313a0192a0c7a43fba11658e67a99c8fe44431e1540608021e1
SSDEEP 384:SJWJWVca12krtuVm+RglBOVjeQ8RJojYghnjUocYW65Pom5s+GDa50R7HcT3MYXX:K+WVcWrGl8RJoYg9jUocY/ds+GDa50RA
TLSH
T167A25A743AF41756F3B29F759AF1A95A653AB866AC00DB4D0122028D0937D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Send to.lnk.js

Path C:\Users\Public\Send to.lnk.js
Size 8KB
SHA256 dafc07e963af693bd4feb63f0cfb0958716b94e12e7f93821691377f3b612fac
MD5 41a9c1c752147b5d568f1904ddfb6ab1
SHA1 8bdcf6fb644a36a9502cef85d5e1bb956b841b33
SHA512 2d12e57c83b318f99a29dc662ecdf34161f3c588172214026c02c863210d48d163e307791eff3b45a5f627d8aff9c9d7c9bb3ef283bbcf8443776623fe722b65
SSDEEP 192:Eck69JLe90nugCtqC8yURLRmc8rQULbe2BoiPooo4hHYfEEJR:vweZRLR1zOoKLHYfL
TLSH
T13CF14B9AF2E2F880C282B17A493F902FE1370E453C16C5BC986695C97D1C6CD46F6EA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3024-10-0x00000288009B0000-0x00000288009DC000-memory.dmp

Download

memory/3024-12-0x000002881AF90000-0x000002881AF98000-memory.dmp

Download

memory/3024-11-0x000002881AF60000-0x000002881AF6A000-memory.dmp

Download

memory/3024-14-0x000002881DC00000-0x000002881DCA8000-memory.dmp

Download

memory/3024-15-0x000002881D830000-0x000002881D852000-memory.dmp

Download

memory/3024-16-0x000002881DF30000-0x000002881E032000-memory.dmp

Download

memory/3024-17-0x000002881D890000-0x000002881D8A4000-memory.dmp

Download