LausivLoader analysis, or how to pass data between malware stages

1. Executive summary

ISC/SANS has published a detailed technical analysis of a LausivLoader sample delivered via a purchase-quotation malspam campaign (a fake fibre-optic supply-chain request impersonating a legitimate company's employee), caught in a mail-gateway quarantine at the end of August 2026. The loader is a multi-stage chain — obfuscated JavaScript → PowerShell → in-memory .NET loader → .NET downloader — that uses an unusual inter-process handoff: payload fragments written to a randomised %TEMP% directory, with their paths passed to the PowerShell stage via inherited process environment variables (Kv7408, Kv562), then deleted. The final stage downloads its payload hidden inside a PNG iTXt chunk (steganography), with the delivery URL already dead at time of analysis, so the ultimate payload family is unknown. No verified reference data was resolved for this item; no attribution is claimed in the source, and none is made here. Direct risk to EMEA financial services is low-to-moderate: the initial-access vector (purchase-order/quotation phishing) targets exactly the procurement and finance roles common in the sector, but the observed sample was quarantined and the final payload was never retrieved.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. This is a single-sample malware analysis of a quarantined malspam message with no confirmed compromise of any entity, no exploited vulnerability, and no identified third-party provider failure — the generic triggers ("a phishing email exists", "patching is required") would be true of virtually any security incident and do not engage a specific article. Clients who find this sample or the IOCs below in their own environment should reassess: a confirmed execution would engage DORA Art. 18 (classification of ICT-related incidents and cyber threats) and, if major, DORA Art. 19 (reporting of major ICT-related incidents to competent authorities) for in-scope financial entities, or NIS2 Art. 23 (incident reporting obligations) / UK NIS 2018 OES/RDSP duties as applicable.

3. Technical analysis & attack chain

Confirmed attack chain (from the ISC/SANS analysis)

1. Delivery. Malspam impersonating an employee of a legitimate company, requesting a price quotation for a fibre-optic system. The message failed SPF and DMARC and was quarantined by the recipient gateway for malicious attachment content. The attachment is an archive with an unusual .r01 extension (WinRAR multi-volume part file) containing a ~613 KB JavaScript file named PO.4843293191 For Supply Chain - Imports HM..js. At time of writing the file scored 28/55 on VirusTotal, with several engines identifying the family as LausivLoader.
2. User execution. Recipient extracts and runs the .js via Windows Script Host (the double-extension HM..js is the lure).
3. Obfuscation. The script contains 450 comment lines of random English words as junk padding; the remaining ~205 KB is lightly obfuscated string-assembly code, largely building long strings via concatenation and String.fromCharCode.
4. Self-copy / persistence. The script copies itself to %LOCALAPPDATA%\Microsoft\PhotoEngine\PhotoStudio.js (creating the Microsoft\PhotoEngine folder tree if absent), then uses the Schedule.Service COM object to register a scheduled task named \MicrosoftEdgeUpdateTaskCore — a logon trigger for the current user (DOMAIN\username), hidden, no execution time limit, launching wscript.exe //B //Nologo against the copied script path, running at LeastPrivilege with InteractiveToken. The task name masquerades as a Microsoft Edge update task.
5. Payload staging via environment variables. The script builds a directory name from a random number (10000–99999 range) plus the current timestamp, both base-36 encoded, and creates it under %TEMP%. It writes two large constructed strings to files named <dirname>a and <dirname>b (ASCII, via ADODB.Stream), then sets process-scope environment variables Kv7408 and Kv562 to those file paths.
6. Execution handoff. The script builds and runs (via WScript.Shell.Run, hidden window): C:\Windows\System32\conhost.exe --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -EncodedCommand <Base64> Because child processes inherit the parent environment, the PowerShell stage receives the two file paths through conhost.exe without them ever being hardcoded or persisted user/machine-wide.
7. PowerShell stage. Reads both files' text, concatenates, deletes both files (Remove-Item -Force -EA 0), Base64-decodes, then decrypts with AES-128-CBC, PKCS#7 padding using a hardcoded key C9 E0 BF 98 DC 0E C6 9C 8D 66 15 17 45 0E C6 C9 and IV 4A 58 21 E3 29 41 DF E5 19 8F CE 68 EC 8A 06 2C (via a System.Security.Cryptography.AesManaged instance created through reflection to evade string-based detection). The plaintext is GZip-decompressed (GZipStream).
8. First .NET loader (315,904 bytes, 64-bit). Not written to disk — loaded via [System.Reflection.Assembly]::Load(byte[]) and its entry point invoked in-process. This loader resolves Windows APIs dynamically and patches AmsiScanBuffer and AmsiScanString to defeat AMSI (the source also lists ETW redirection attempts in its TTP mapping). It embeds a 299,520-byte array containing the next stage, but keeps only every fifth byte (offsets 0, 5, 10, …) before RC4-decrypting — yielding a 59,904-byte second .NET executable.
9. Second .NET downloader (59,904 bytes). Adds the network dependency. Its decoded configuration points to hxxps[:]//yapw[.]life/phpt/stego_zrgaixkku8.png — dead at time of analysis. The downloader would parse the PNG structure, locate an iTXt chunk, search within it for the marker FF 89 AD 4A, read a payload length, XOR-decrypt, and DEFLATE-decompress. The recovered bytes must begin with MZ.
10. Final payload (unknown). The downloader branches on whether the recovered PE is a managed .NET assembly (loaded via reflection in-memory) or a native executable (executed via process hollowing). The PNG was never retrieved, so the final payload family and execution path are unknown.

Analytically noteworthy: the environment-variable handoff means a decoded -EncodedCommand blob analysed in isolation is non-functional — the paths live in the parent process environment, not the command line. Analysts should expect this pattern to defeat naive command-line-only triage.

Confidence caveat: this entire chain is single-sourced — one ISC/SANS diary entry by Jan Kopriva (Nettles Consulting), analysing one quarantined sample. The LausivLoader family identification comes from VirusTotal engine detections cited in that same source. No second vendor report corroborates the chain, the IOCs, or the family attribution. Verify before enforcement.

4. Mitigation & containment

P1 — within 24 hours

• Hunt for the IOCs in §5 across email gateways, endpoints and proxy logs: the three file hashes, the yapw[.]life domain/URL, the scheduled-task name MicrosoftEdgeUpdateTaskCore, and the %LOCALAPPDATA%\Microsoft\PhotoEngine\PhotoStudio.js path. A hit on the task name or the PhotoEngine path indicates the persistence stage ran.
• Block yapw[.]life at proxy/DNS (the URL is dead, but the domain may be reused).
• Contain any confirmed execution: remove the scheduled task (schtasks /delete /tn "\MicrosoftEdgeUpdateTaskCore" /f), delete %LOCALAPPDATA%\Microsoft\PhotoEngine\, isolate the host, and treat the process tree wscript.exe → conhost.exe → powershell.exe as compromised — the final payload is unknown, so assume capability until proven otherwise.
• Mail-gateway review: search quarantine and logs for the sender pattern — purchase-quotation lures with .r01/multi-part-archive attachments and .js content, and for the specific filename PO.4843293191 For Supply Chain - Imports HM..js.

P2 — within 72 hours

• Attachment policy: block or force-sandbox archive attachments with non-standard extensions (.r01, .r00, .part, etc.) and any .js/.jse content at the gateway. Confirm SPF/DMARC enforcement is in reject/quarantine mode — the sample's mail failed both, which is a working control here.
• Endpoint hardening: if not already in place, disable Windows Script Host for standard users (via GPO registry HKLM\Software\Microsoft\Windows Script Host\Settings\Enabled = 0, with exceptions as needed) and enforce ASR rules including "Block JavaScript or VBScript from launching downloaded executable content" and "Block Win32 API calls from Office macros" where applicable.
• Deploy the §6 detections to EDR/SIEM.

P3 — within 7 days

• User awareness targeting procurement/AP staff: the lure is a supplier price-quotation request — precisely the roles that handle unsolicited PO attachments. Circulate the lure pattern (fibre-optic supply enquiry, PO-numbered .js inside an .r01 archive).
• AMSI/ETW assurance: the chain explicitly patches AmsiScanBuffer/AmsiScanString. Confirm EDR telemetry does not rely solely on AMSI-inspected PowerShell content; enable PowerShell script-block logging (4104) and transcription so encoded-command payloads are captured at invocation regardless of AMSI state.

5. Indicators of compromise

All indicators are single-sourced (one ISC/SANS report); verify before enforcement.

md5  7acd5c5f1689332615c03357e143f51e
sha256  408b2df6e81824fa5bdf4f0fbd185a7e6db06e2be98fbeebce416f66954b9fa9
md5  5d92d1fb5d5fbd79a588f22e994a4aff
sha256  e4130bf8769a50106a963b6a43dfd4fe5b56c70eae76a0de971d25993159acfe
md5  f351968c76eefc80d4e292a3f179b7b9
sha256  be73e8b06c4356b5b4644d69b4f426bb3b32b4bf9f14cc5743f17532799f760b
url  hxxps://yapw[.]life/phpt/stego_zrgaixkku8.png
filepath  %LOCALAPPDATA%\Microsoft\PhotoEngine\PhotoStudio.js
scheduled-task  \MicrosoftEdgeUpdateTaskCore
env-var  Kv7408
env-var  Kv562

Behavioural indicators (observable activity; not in the copyable block):

6. Detection

The source provides distinctive artefacts: the scheduled-task name, the persistence file path, the environment-variable names, the PowerShell flag string, and the PNG marker bytes.

rule LausivLoader_June2026_Chain
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-17"
        reference = "https://isc.sans.edu/diary/rss/33348"
        description = "Detects LausivLoader chain artefacts: scheduled task name, persistence path, env-var handoff, PowerShell flags"
    strings:
        $task = "MicrosoftEdgeUpdateTaskCore" ascii
        $path = "\\Microsoft\\PhotoEngine\\PhotoStudio.js" ascii wide
        $env1 = "Kv7408" ascii wide
        $env2 = "Kv562" ascii wide
        $ps_flags = " -NoP -NonI -W Hidden -EncodedCommand " ascii
        $conhost = "conhost.exe --headless" ascii wide
        $wscript_args = "//B //Nologo" ascii wide
        $marker = { FF 89 AD 4A }
    condition:
        uint16(0) == 0x5A4D or filesize < 700000 and (3 of ($task, $path, $env1, $env2, $ps_flags, $conhost, $wscript_args)) or (2 of them and $marker)
}

Note: $marker (FF 89 AD 4A) alone is weak — require corroboration. The Kv7408/Kv562 variable names and the task name are the strongest strings.

title: LausivLoader persistence via MicrosoftEdgeUpdateTaskCore scheduled task
id: 941a7c1e-2026-4d17-941a-7c1e20264d17
status: experimental
description: Detects creation of the LausivLoader logon task masquerading as a Microsoft Edge update task, launching wscript.exe against a user-profile .js path.
references:

    - https://isc.sans.edu/diary/rss/33348
author: Adverse Trace
date: 2026/09/17
logsource:
    product: windows
    category: process_creation
detection:
    selection_task:
        CommandLine|contains:

            - 'MicrosoftEdgeUpdateTaskCore'
    selection_exec:
        CommandLine|contains:

            - 'wscript.exe'
            - 'schtasks'
    selection_payload:
        CommandLine|contains:

            - 'PhotoStudio.js'
            - 'PhotoEngine'
    condition: selection_task and selection_exec and selection_payload
falsepositives:

    - Legitimate Microsoft Edge update tasks (verify path is not %LOCALAPPDATA%\Microsoft\PhotoEngine\)
level: high

title: LausivLoader hidden PowerShell chain via conhost --headless
id: 2b5e8f3a-2026-4d17-8f3a-2b5e8f3a2026
status: experimental
description: Detects the LausivLoader execution chain: conhost.exe launching hidden PowerShell with an encoded command.
references:

    - https://isc.sans.edu/diary/rss/33348
author: Adverse Trace
date: 2026/09/17
logsource:
    product: windows
    category: process_creation
detection:
    selection_conhost:
        Image|endswith: '\conhost.exe'
        CommandLine|contains: '--headless'
    selection_powershell:
        CommandLine|contains:

            - 'powershell.exe'
            - '-EncodedCommand'
    filter_legit:
        ParentImage|endswith:

            - '\WindowsTerminal.exe'
    condition: selection_conhost and selection_powershell and not filter_legit
falsepositives:

    - Some legitimate console applications invoke conhost --headless; require the powershell.exe + -EncodedCommand combination.
level: high

7. Sources

• ISC/SANS Internet Storm Center, Jan Kopriva (Nettles Consulting), "LausivLoader analysis, or how to pass data between malware stages", https://isc.sans.edu/diary/rss/33348, 2026-09-17
• VirusTotal file record for the initial JavaScript (SHA-256 408b2df6e81824fa5bdf4f0fbd185a7e6db06e2be98fbeebce416f66954b9fa9), https://www.virustotal.com/gui/file/408b2df6e81824fa5bdf4f0fbd185a7e6db06e2be98fbeebce416f66954b9fa9 (cited within the ISC/SANS report)

8. Adverse Trace position

This is a well-documented but single-sourced analysis of one quarantined LausivLoader sample; we assess direct risk to EMEA financial services as low-to-moderate — the initial-access lure (supplier quotation with PO-numbered attachment) is squarely aimed at procurement and accounts-payable roles, but the observed delivery was stopped at the gateway, the final payload was never recovered, the delivery URL is dead, and no attribution, campaign scale, or victimology is established. The chain's techniques are the real takeaway for defenders: environment-variable inter-stage handoff that defeats isolated command-line analysis, AMSI patching, every-fifth-byte RC4 packing, and PNG iTXt steganography for payload delivery — all of which reduce the value of signature- and AMSI-dependent controls and argue for script-block logging, EDR process-environment capture, and gateway blocking of non-standard archive extensions. No verified reference data was resolved for this item, so no CVSS, KEV or MITRE-actor attribution is asserted; the LausivLoader family identification rests on VirusTotal engine detections in a single vendor report and should be treated as unconfirmed. We will monitor for multi-source corroboration of the family, any live yapw[.]life infrastructure or successor domains, and identification of the final payload, and will update this advisory if the chain is observed in the wild against financial-sector targets.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.