Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 06:03
General
- Target Purchase Inquiry.js
- Size 997KB
- Sample260910-gr57lsyhpf
- SHA256 1ca4d33830158394c4324e9972c7dc32fbb7a39e7e14112abbefa9733902352b
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry.js"1⤵
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\dsn34mj0\tmp_109181_e119.cmd1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\dsn34mj0\log_14547_e10a.dat" "2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -nop -w h -Command -2⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" process where ProcessId=3392 get CommandLine /value4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
- Loads dropped DLL
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_7d17e57b.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_7d17e57b.tmp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E1F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3054FB05F13E42E5A4463E4C31956043.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.dfc_7d17e57b.dat"C:\Users\Admin\AppData\Local\Temp\.dfc_7d17e57b.dat" 888 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\chrome.sync.37704.7332.2AFC"4⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_18b278d3.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_18b278d3.tmp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA071.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAA6F212847410EB5265CDE4398D5F5.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.dfc_18b278d3.dat"C:\Users\Admin\AppData\Local\Temp\.dfc_18b278d3.dat" "C:\Program Files\Mozilla Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fbrj04v0.Admin|Admin;C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release|default-release" "C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\Firefox"4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
msasn1.dll
.dfc_18b278d3.dat
.dfc_7d17e57b.dat
RES9E1F.tmp
RESA071.tmp
__PSScriptPolicyTest_jdcamgfc.fbd.ps1
d97f699552204ae7a65c9f566a2416ad.db
cfg_23798_e10a
clr_51176_e10a
log_14547_e10a.dat
tmp_109181_e119.cmd
.dfc_18b278d3.tmp
.dfc_7d17e57b.tmp
CSC3054FB05F13E42E5A4463E4C31956043.TMP
CSCAA6F212847410EB5265CDE4398D5F5.TMP
memory/452-100-0x0000000000A20000-0x0000000000A26000-memory.dmp
memory/1468-70-0x0000000000700000-0x0000000000706000-memory.dmp
memory/2104-30-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2104-56-0x00000000086C0000-0x0000000008710000-memory.dmp
memory/2104-31-0x00000000063A0000-0x0000000006944000-memory.dmp
memory/2104-58-0x0000000008FE0000-0x000000000950C000-memory.dmp
memory/2104-57-0x00000000088E0000-0x0000000008AA2000-memory.dmp
memory/2104-38-0x0000000007700000-0x0000000007792000-memory.dmp
memory/2104-39-0x00000000079B0000-0x00000000079BA000-memory.dmp
memory/3392-27-0x0000000006B30000-0x0000000006B4A000-memory.dmp
memory/3392-22-0x0000000006550000-0x000000000656E000-memory.dmp
memory/3392-32-0x0000000007860000-0x00000000078F6000-memory.dmp
memory/3392-28-0x0000000007760000-0x000000000777A000-memory.dmp
memory/3392-29-0x0000000007780000-0x0000000007788000-memory.dmp
memory/3392-26-0x0000000007BA0000-0x000000000821A000-memory.dmp
memory/3392-23-0x0000000006590000-0x00000000065DC000-memory.dmp
memory/3392-33-0x0000000007800000-0x0000000007822000-memory.dmp
memory/3392-21-0x0000000005FA0000-0x00000000062F4000-memory.dmp
memory/3392-13-0x0000000005F30000-0x0000000005F96000-memory.dmp
memory/3392-12-0x0000000005630000-0x0000000005696000-memory.dmp
memory/3392-11-0x0000000005590000-0x00000000055B2000-memory.dmp
memory/3392-10-0x0000000005790000-0x0000000005DB8000-memory.dmp
memory/3392-9-0x0000000002F60000-0x0000000002F96000-memory.dmp
memory/3392-8-0x0000000005150000-0x0000000005160000-memory.dmp