4dfdc3874ca9025f34c5890e2389aa66cf0e9da59690fb3ebcafc042bb2643de

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/11/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0x29357B37392BA9A6.js
Size 103.0MB
Sample261112-prwbeagv21
SHA256 4dfdc3874ca9025f34c5890e2389aa66cf0e9da59690fb3ebcafc042bb2643de
MD5 9e7028a94c2f4e1e07d74fe8a7f66e00
SHA1 1c2fb4259607d7d146226bf77ceb0fb2f8b9aa81
SHA512 d758a7b009c51bd0a485326a60c41b84551f7a40f9c8bd5b894f612fb934332a339ca231af537a5671f3cb3f8964c1ad60a17c1447fb56990f9f1a3bcdb29964
SSDEEP 3072:PGEbUxkTw0+6i8ylD8c33AVKq16aq1hvqRQpxfk3K2llU45o5r1VZui90a5llgEn:56iCbG8ulX
TLSH
T15738AA20A5594E3CF0A70D38C8A9560706AE25E6F3399DCC22871D571F93329A4E7FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://pub-0bec69f492554744a0832f57d2301bfd.r2.dev/vtyukl.jpg
exe.dropper
https://pub-0bec69f492554744a0832f57d2301bfd.r2.dev/vtyukl.jpg

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5708	5816	powershell.exe	85

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	5708	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5708	powershell.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/5708-14-0x00000271FAEA0000-0x00000271FAEC4000-memory.dmp	net_reactor

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5708	powershell.exe
5708	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5708	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\0x29357B37392BA9A6.js
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:4736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Admin\AppData\Local\Temp\rad4D5B5.tmp.ps1'; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\rad4D5B5.tmp.ps1' -Force -ErrorAction SilentlyContinue"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_u2bn5hen.0ug.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2bn5hen.0ug.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rad4D5B5.tmp.ps1

Path C:\Users\Admin\AppData\Local\Temp\rad4D5B5.tmp.ps1
Size 2KB
SHA256 8caa7b4c66ae73c93805e3e0f1679114a992eb19abb9e7ad05f616f6695748d3
MD5 ced53dd8f353243535f5f3a10d9e9773
SHA1 f6147d5b1675af331f8d4199c7013b9e2ab86bc8
SHA512 23b7dd713290ccc1e7b6e1cdffc99220231dae8c9bf28203e00e13cff636d582a19c348c0bfcfab9f48bdf48fe3a6a0f92b4aeb4c80b4c57c1becc884567f4bb
TLSH
T1E741E733C75A429B0106A6B860C3CAD1EC170D4F09C2388D3F8DC96DEE84CDC2199A17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5708-1-0x00000271FAEE0000-0x00000271FAEF0000-memory.dmp

Download

memory/5708-2-0x00000271FAEE0000-0x00000271FAEF0000-memory.dmp

Download

memory/5708-10-0x00000271FAE30000-0x00000271FAE52000-memory.dmp

Download

memory/5708-12-0x00000271FAEE0000-0x00000271FAEF0000-memory.dmp

Download

memory/5708-13-0x00000271FAEE0000-0x00000271FAEF0000-memory.dmp

Download

memory/5708-14-0x00000271FAEA0000-0x00000271FAEC4000-memory.dmp

Download

memory/5708-17-0x00000271FD060000-0x00000271FD27C000-memory.dmp

Download