Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
03/07/2026, 18:40
General
- Target Enquiry_RFQ_M&R_TRADING_20260624.js
- Size 1.5MB
- Sample260703-xbhdlset4v
- SHA256 1c4a7c2235c522107a2934f5fcc0d9dea43dd9343c3864d73c456a00116c0fe6
Malware Config
Signatures
- Badlisted process makes network request 20 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Enquiry_RFQ_M&R_TRADING_20260624.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless powershell.exe -WindowStyle Hidden -W H -nop -NOnI -Command "&([scriptblock]::Create($env:EHXQTfbptrkNYk))"2⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -W H -nop -NOnI -Command &([scriptblock]::Create($env:EHXQTfbptrkNYk))3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/968-0-0x00007FFDF50EF000-0x00007FFDF50F0000-memory.dmp
memory/968-1-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-4-0x0000022111E30000-0x0000022111E52000-memory.dmp
memory/968-5-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-6-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-7-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-8-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-9-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-10-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-11-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-12-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-13-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-14-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-15-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-16-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-17-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-18-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-19-0x000002210F530000-0x000002210F58A000-memory.dmp
memory/968-20-0x000002210F590000-0x000002210F5A0000-memory.dmp
memory/968-21-0x0000022129FF0000-0x000002212A0B6000-memory.dmp
memory/968-22-0x000002212AF90000-0x000002212B00A000-memory.dmp
memory/968-23-0x000002212B010000-0x000002212B0E8000-memory.dmp
memory/968-24-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-25-0x000002210F610000-0x000002210F65C000-memory.dmp
memory/968-27-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp
memory/968-28-0x00007FFDF4F60000-0x00007FFDF5904000-memory.dmp