Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/07/2026, 00:17
General
- Target Enquiry.js
- Size 2.0MB
- Sample260709-aleddaaz5k
- SHA256 3d99aeca7a9c67dec8cf45f34dad6301ba104b8c7f4a1a6454276ca4403a79c8
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Enquiry.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Invoke-Expression $env:chemisette"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_v3xknzzn.oa4.ps1
memory/1428-1-0x0000024FA9E60000-0x0000024FA9E70000-memory.dmp
memory/1428-0-0x0000024FA9E60000-0x0000024FA9E70000-memory.dmp
memory/1428-9-0x0000024FABC60000-0x0000024FABC82000-memory.dmp
memory/1428-10-0x0000024FC6340000-0x0000024FC63F4000-memory.dmp
memory/1428-11-0x0000024FABC50000-0x0000024FABC5A000-memory.dmp
memory/1428-12-0x0000024FA9E60000-0x0000024FA9E70000-memory.dmp
memory/1428-13-0x0000024FA9E60000-0x0000024FA9E70000-memory.dmp