Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 08:09
General
- Target SHIPMENT DOCUMENTS SCAN_92926tqyp.js
- Size 674KB
- Sample260930-j2mt5aae56
- SHA256 62165ab180dc2a8278bb60785308b08d997328046d6c843d761ec6d9ace3c15e
Malware Config
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOCUMENTS SCAN_92926tqyp.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:WPAIWGU))2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\73807566987165.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\73807566987165.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZNAMPRVOMKFU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:JQQOFUINBW))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZNAMPRVOMKFU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:JQQOFUINBW))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZNAMPRVOMKFU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:JQQOFUINBW))"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\73807566987165.cmd"3⤵
- Views/modifies file attributes
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
73807566987165.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0d0p4eot.q0k.ps1
handoff_dbg_4420_e59c7f9.txt
handoff_dbg_4420_e59c7f9.txt
memory/2956-6-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-9-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-10-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-12-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-13-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-15-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-8-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-7-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-0-0x00007FFD7C05F000-0x00007FFD7C060000-memory.dmp
memory/2956-5-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-3-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-50-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/2956-4-0x0000011A8ACC0000-0x0000011A8ACE2000-memory.dmp
memory/4420-32-0x0000000006390000-0x00000000066EB000-memory.dmp
memory/4420-43-0x0000000070CC0000-0x0000000070D0C000-memory.dmp
memory/4420-28-0x0000000005AE0000-0x0000000005B46000-memory.dmp
memory/4420-34-0x00000000066F0000-0x000000000670E000-memory.dmp
memory/4420-35-0x0000000006720000-0x000000000676C000-memory.dmp
memory/4420-37-0x0000000007F70000-0x00000000085EC000-memory.dmp
memory/4420-38-0x0000000006CE0000-0x0000000006CFA000-memory.dmp
memory/4420-39-0x0000000007990000-0x0000000007A26000-memory.dmp
memory/4420-40-0x0000000007920000-0x0000000007942000-memory.dmp
memory/4420-41-0x0000000008BB0000-0x000000000916A000-memory.dmp
memory/4420-42-0x0000000007CE0000-0x0000000007D16000-memory.dmp
memory/4420-29-0x0000000005B50000-0x0000000005BB6000-memory.dmp
memory/4420-47-0x0000000007D20000-0x0000000007D40000-memory.dmp
memory/4420-44-0x0000000070E20000-0x000000007117B000-memory.dmp
memory/4420-48-0x0000000007D50000-0x0000000007DF3000-memory.dmp
memory/4420-49-0x0000000007E60000-0x0000000007E6A000-memory.dmp
memory/4420-27-0x0000000005940000-0x0000000005962000-memory.dmp
memory/4420-51-0x0000000003300000-0x0000000003311000-memory.dmp
memory/4420-52-0x0000000007EC0000-0x0000000007ED0000-memory.dmp
memory/4420-53-0x0000000007ED0000-0x0000000007EE5000-memory.dmp
memory/4420-54-0x0000000007F20000-0x0000000007F3C000-memory.dmp
memory/4420-55-0x0000000007F40000-0x0000000007F48000-memory.dmp
memory/4420-26-0x0000000005D40000-0x000000000638A000-memory.dmp
memory/4420-25-0x0000000003420000-0x0000000003456000-memory.dmp
memory/5740-60-0x0000000010000000-0x0000000010040000-memory.dmp
memory/5740-79-0x0000000003220000-0x0000000003260000-memory.dmp
memory/5740-57-0x0000000001210000-0x0000000001250000-memory.dmp
memory/5740-74-0x0000000001210000-0x0000000001250000-memory.dmp
memory/5740-56-0x0000000001210000-0x0000000001250000-memory.dmp
memory/5740-108-0x0000000001650000-0x0000000001660000-memory.dmp
memory/5740-102-0x00000000015A0000-0x00000000015DB000-memory.dmp
memory/5740-95-0x00000000012E0000-0x000000000131B000-memory.dmp
memory/5740-151-0x0000000010000000-0x0000000010040000-memory.dmp
memory/5740-205-0x0000000001650000-0x0000000001660000-memory.dmp
memory/5740-250-0x0000000003200000-0x0000000003210000-memory.dmp
memory/5740-167-0x00000000579F0000-0x00000000579F1000-memory.dmp
memory/5740-165-0x00000000579E0000-0x00000000579E1000-memory.dmp
memory/5740-161-0x00000000542A0000-0x00000000542A1000-memory.dmp
memory/5740-157-0x0000000054280000-0x0000000054281000-memory.dmp
memory/5740-141-0x0000000003200000-0x0000000003210000-memory.dmp
memory/5740-127-0x0000000003020000-0x0000000003021000-memory.dmp
memory/5740-126-0x0000000003010000-0x0000000003011000-memory.dmp
memory/5740-104-0x00000000015E0000-0x0000000001600000-memory.dmp
memory/5740-103-0x00000000015E0000-0x0000000001600000-memory.dmp
memory/5740-159-0x0000000054290000-0x0000000054291000-memory.dmp
memory/5740-85-0x0000000001080000-0x0000000001082000-memory.dmp
memory/5740-80-0x0000000000400000-0x0000000000440000-memory.dmp
memory/5740-76-0x00000000015E0000-0x0000000001600000-memory.dmp
memory/5740-280-0x00000000062B0000-0x0000000006300000-memory.dmp
memory/5740-281-0x00000000063A0000-0x0000000006432000-memory.dmp
memory/5740-282-0x0000000006290000-0x000000000629A000-memory.dmp
memory/5740-354-0x0000000003020000-0x0000000003021000-memory.dmp
memory/5740-377-0x00000000032C0000-0x00000000032D0000-memory.dmp
memory/5740-452-0x0000000054D40000-0x0000000054D41000-memory.dmp
memory/5740-450-0x0000000054D30000-0x0000000054D31000-memory.dmp
memory/5740-446-0x0000000054D10000-0x0000000054D11000-memory.dmp
memory/5740-444-0x0000000054D00000-0x0000000054D01000-memory.dmp
memory/5740-423-0x0000000005C60000-0x0000000005C70000-memory.dmp
memory/5740-422-0x0000000005C50000-0x0000000005C60000-memory.dmp
memory/5740-421-0x0000000005C40000-0x0000000005C50000-memory.dmp
memory/5740-420-0x0000000005C30000-0x0000000005C40000-memory.dmp
memory/5740-414-0x0000000005A80000-0x0000000005A90000-memory.dmp
memory/5740-413-0x0000000005A70000-0x0000000005A80000-memory.dmp
memory/5740-411-0x0000000005A60000-0x0000000005A70000-memory.dmp
memory/5740-392-0x00000000057A0000-0x00000000057B0000-memory.dmp
memory/5740-376-0x00000000032B0000-0x00000000032C0000-memory.dmp
memory/5740-368-0x00000000031F0000-0x0000000003200000-memory.dmp
memory/5740-353-0x0000000003010000-0x0000000003011000-memory.dmp
memory/5740-316-0x0000000001650000-0x0000000001660000-memory.dmp
memory/5740-389-0x0000000005720000-0x0000000005730000-memory.dmp
memory/5740-469-0x0000000000AD0000-0x0000000000ADB000-memory.dmp