7dbcab2b8bdfe6d83cfeb8de792f58b2519d652209bbf5cbfa447a5f2258735c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
orden de compra (OC).js
Size 3.3MB
Sample261110-sdk53avvb1
SHA256 7dbcab2b8bdfe6d83cfeb8de792f58b2519d652209bbf5cbfa447a5f2258735c
MD5 b3cd2d9319e3434c18dd320e577e528e
SHA1 2779d5fab6151c8c4f2657d3b54c8263530a8bd8
SHA512 f7ffeb79a4c9efda9420fe683037c71c748aaf179a7b0685c4b9775c97f4b79c4741c31978806563480278e2e8bed91db4af631255c9c5988117495a1d03e134
SSDEEP 98304:7mdfI/14mMGFafP636ycu91wo0xrAI7R0s7gubSItjA7q87gfnbizEswOV758O1a:Ug1mUiPekuP30xE+Gs7gllgje0
TLSH
T137F5E5411F4FB17276226B4C4636CD3C990A60D329DADF3E30A9B214F668D07A75CBE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4716	XJWDZCCSAAWSCREQ.exe

Loads dropped DLL 1 IoCs

pid	Process
4716	XJWDZCCSAAWSCREQ.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3312	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	wscript.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\orden de compra (OC).js:Zone.Identifier	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3312	3444	wscript.exe	89
PID 3444 wrote to memory of 4716	3444	wscript.exe	91

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\orden de compra (OC).js"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\orden de compra (OC).js:Zone.Identifier"
  2⤵
  - Executes a command shell one-liner
  - NTFS ADS
  PID:3312
- C:\Users\Admin\Documents\XJWDZCCSAAWSCREQ.exe
  "C:\Users\Admin\Documents\XJWDZCCSAAWSCREQ.exe" C:\Users\Admin\Documents\QERCSWAASCCZDWJX
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QERCSWAASCCZDWJX

Path C:\Users\Admin\Documents\QERCSWAASCCZDWJX
Size 585KB
SHA256 b662c9f8de75677f38f1afd4af61f83fc98077ef4d8a601d97ff3ce95c9e904c
MD5 a7b9d3dadd036d09f43766bfac43497b
SHA1 6030a512244e12341eb7a22b800d9f0b075125a0
SHA512 ededc69c694f20f9d6a8797411b78433b4059830ef272dcea57785bf8fa6e94a6b5f707b6f05ddcc083c904bc1208864218d987fd429c0c9511ac4549facb115
SSDEEP 12288:HawGibOyJ20K/im9TnBxgetZzCXPULNgEYeBjj/pSVFr1xUrAzcVV:HawlJ20WiOLHnqPGoeBjj/pSVFr1xUrR
TLSH
T193D439C7708E29A492EE42B0CC6B0A9B70B5C9FA034E56474F94D0F5775167CCBE983A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XJWDZCCSAAWSCREQ.exe

Path C:\Users\Admin\Documents\XJWDZCCSAAWSCREQ.exe
Size 27KB
SHA256 70916418ff0b6c2a12e8897ff622bdbb115435d38f0afe3ea981de1e7652ebb4
MD5 a989e1ff8e0e2a090e65226a2cfc6315
SHA1 31b7e7644a1445ebe7ee90b8100ece52374777dc
SHA512 ca2314748e9e65462f01a1c51754d17f93bbc1ef47dc84cac784c36744184c5f5ebec370fce138dfd8c22196f87b58a91f28185cb88a9fd716e05cea6c8ed6d3
SSDEEP 192:V2JOj62kV6yge14ANwRZTrA3GfQJkd4+G7SgrgX/QgESiIU8ZcGwuttnhlM49abK:vkAe/QZvfQm49Xr4IJXutRU499mgYPWt
TLSH
T1B6C2F73FB6565CFEC142C37898D746327072782197232A6F0718A632AF71B749A6F12D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua51.dll

Path C:\Users\Admin\Documents\lua51.dll
Size 439KB
SHA256 2f52407927015a8bf4a2a6765ccb599bc438c9a19e1d4a5dda1f5292a0c0e50a
MD5 028b7c1c451765479927a369b0766fa2
SHA1 c960a19bd5f5d86d2629f102c175984015885f40
SHA512 424a5b472845d75055642d6abc8802a4abdff845c0910f8fc346b627071ba1cf515903864878a95ba6b944e5cc9ef006e1de5ee0b486c6bf5ba24d85c26aa496
SSDEEP 12288:eThHrqR5EtmwgObhTLRFA8nmKlTD8ju3F3Mx:eN85EtmgvHmyTDeu3F3Mx
TLSH
T1AEA4380BA2B356BCC6678170876BAB72A931FC1511307DBE1998FB312D31D909B9F52C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4716-14-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4716-15-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4716-16-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4716-17-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4716-19-0x0000000066D80000-0x0000000066DF4000-memory.dmp

Download

memory/4716-18-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4716-20-0x00000000025E0000-0x0000000002F84000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads