Dropped-file hash links JavaScript to task-targeted payload
A sandboxed JavaScript sample dropped an executable whose hash matches a separately analyzed file that requested a logon-triggered task targeting the same path. The match connects the script and payload by content, while the script’s Run setting and the executable’s task command show distinct launch mechanisms.
A JavaScript sandbox analysis recorded a file named WindowsUpdate.exe in a user’s temporary directory. Its SHA-256 matched a separately analyzed executable that requested a logon-triggered scheduled task pointing to that same location. The match answers the central question in this case: are the script, the executable and their launch settings merely similar-looking alerts, or do they describe connected components?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read