b4c342bc88877089e249af27f97af35ee19dc831191d6059b5967048a0e69d64

Analysis

max time kernel
298s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO- OLCM- 105-0223- Oct 27 - 500 Olivetti Pr2 Plus Printers.js
Size 127KB
Sample261027-qlel5styhz
SHA256 b4c342bc88877089e249af27f97af35ee19dc831191d6059b5967048a0e69d64
MD5 b025ea85f8c4ff0585739f349f4e0622
SHA1 7af1a8cdcd24aa9e117382a98a9831f573c5832d
SHA512 19bbe1657d1683bbe7eca7d7fef70b8db167261959bd9d7a9b6b0d48b42a92ffde33414bbe5fb58a4e6513a4a1d2e3ab6d2fbb11c8871bcbb6bd9df8ba07a495
SSDEEP 3072:+4tMvar9EAJUp1USrKHj04OmMEH60c0aO0XgV6rOci1dOMMCyKbgdbz6tGYC2uLk:eOJUp1Uh6JOcgVOpMP
TLSH
T193D3C04317D6424570B36A46D7B668D1CE7BB7A2A6354208134D3F0F4B63898ECA3B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://lingering-cloud-8a93.zinhoooo.workers.dev/afdztmef
exe.dropper
https://lingering-cloud-8a93.zinhoooo.workers.dev/afdztmef

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	2484	powershell.exe	85

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4512	powershell.exe
12	4512	powershell.exe
13	4512	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4512	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4512	powershell.exe
4512	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO- OLCM- 105-0223- Oct 27 - 500 Olivetti Pr2 Plus Printers.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:2772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Admin\AppData\Local\Temp\rad0474D.tmp.ps1'; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\rad0474D.tmp.ps1' -Force -ErrorAction SilentlyContinue"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_u1vgs200.zzq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u1vgs200.zzq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rad0474D.tmp.ps1

Path C:\Users\Admin\AppData\Local\Temp\rad0474D.tmp.ps1
Size 1KB
SHA256 c942fb9d026ef01338f4206d935ba08296630f77e5e3c0c007d2bb17aa22cce1
MD5 ae43958029c66e15c42e10278fa1d4cf
SHA1 2462bcb32adbd4ae2c932896f567df5feb667e08
SHA512 c2fc32139bb7d4fb510dbb0083efc5bf2ee540d3216e134418d1630cff17ad1a81a3365230905d2343f70c5be042904c65b3ab4c71ee348480eef881c3c277ea
TLSH
T19141849ED333BBA0C9CD27D073521E518DA4266AD0702FB1DD6CBC0A651412526F8ED6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4512-2-0x0000020560880000-0x0000020560890000-memory.dmp

Download

memory/4512-1-0x0000020560880000-0x0000020560890000-memory.dmp

Download

memory/4512-8-0x0000020560830000-0x0000020560852000-memory.dmp

Download

memory/4512-12-0x0000020562F00000-0x0000020562F1C000-memory.dmp

Download

memory/4512-13-0x0000020560880000-0x0000020560890000-memory.dmp

Download

memory/4512-15-0x0000020560880000-0x0000020560890000-memory.dmp

Download

memory/4512-14-0x0000020560880000-0x0000020560890000-memory.dmp

Download

memory/4512-16-0x0000020560880000-0x0000020560890000-memory.dmp

Download

memory/4512-17-0x0000020560880000-0x0000020560890000-memory.dmp

Download