Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 09:40
General
- Target purchase order.js
- Size 691KB
- Sample260930-lm7bbstybw
- SHA256 c4dd621b13407af995b5989f7287f8500339fc83e50ddc26f6f669596213a5f5
Malware Config
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\purchase order.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:DYZXCCO))2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\124213853169558.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\124213853169558.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:NCRUAVAR));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CBHSXNCIVX))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:NCRUAVAR));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CBHSXNCIVX))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:NCRUAVAR));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CBHSXNCIVX))"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\124213853169558.cmd"3⤵
- Views/modifies file attributes
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
124213853169558.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0g5i3dze.lsm.ps1
handoff_dbg_3216_e590323.txt
handoff_dbg_3216_e590323.txt
memory/1572-296-0x0000000005DD0000-0x0000000005E20000-memory.dmp
memory/1572-311-0x00000000009F0000-0x0000000000A00000-memory.dmp
memory/1572-494-0x00000000009C0000-0x00000000009CA000-memory.dmp
memory/1572-391-0x0000000004E90000-0x0000000004EA0000-memory.dmp
memory/1572-401-0x0000000004FF0000-0x0000000005000000-memory.dmp
memory/1572-421-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/1572-422-0x00000000052C0000-0x00000000052D0000-memory.dmp
memory/1572-441-0x0000000005C90000-0x0000000005CA0000-memory.dmp
memory/1572-442-0x0000000005CA0000-0x0000000005CB0000-memory.dmp
memory/1572-446-0x0000000005CE0000-0x0000000005CE1000-memory.dmp
memory/1572-117-0x0000000000D00000-0x0000000000D20000-memory.dmp
memory/1572-465-0x0000000054970000-0x0000000054971000-memory.dmp
memory/1572-467-0x0000000054980000-0x0000000054981000-memory.dmp
memory/1572-471-0x00000000549A0000-0x00000000549A1000-memory.dmp
memory/1572-473-0x00000000549B0000-0x00000000549B1000-memory.dmp
memory/1572-427-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/1572-362-0x0000000002810000-0x0000000002811000-memory.dmp
memory/1572-363-0x0000000002820000-0x0000000002821000-memory.dmp
memory/1572-364-0x0000000002830000-0x0000000002840000-memory.dmp
memory/1572-374-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/1572-376-0x0000000002910000-0x0000000002920000-memory.dmp
memory/1572-297-0x0000000005D20000-0x0000000005D2A000-memory.dmp
memory/1572-295-0x0000000005D30000-0x0000000005DC2000-memory.dmp
memory/1572-248-0x0000000002840000-0x0000000002850000-memory.dmp
memory/1572-202-0x00000000009F0000-0x0000000000A00000-memory.dmp
memory/1572-74-0x00000000008C0000-0x0000000000900000-memory.dmp
memory/1572-75-0x00000000008C0000-0x0000000000900000-memory.dmp
memory/1572-78-0x0000000010000000-0x0000000010040000-memory.dmp
memory/1572-91-0x0000000000D00000-0x0000000000D20000-memory.dmp
memory/1572-164-0x0000000010000000-0x0000000010040000-memory.dmp
memory/1572-89-0x00000000008C0000-0x0000000000900000-memory.dmp
memory/1572-95-0x0000000000400000-0x0000000000450000-memory.dmp
memory/1572-143-0x0000000002840000-0x0000000002850000-memory.dmp
memory/1572-140-0x0000000002820000-0x0000000002821000-memory.dmp
memory/1572-115-0x0000000000CC0000-0x0000000000CFC000-memory.dmp
memory/1572-122-0x0000000000D70000-0x0000000000DB0000-memory.dmp
memory/1572-171-0x0000000053E90000-0x0000000053E91000-memory.dmp
memory/1572-174-0x0000000053EB0000-0x0000000053EB1000-memory.dmp
memory/1572-139-0x0000000002810000-0x0000000002811000-memory.dmp
memory/1572-108-0x00000000009F0000-0x0000000000A00000-memory.dmp
memory/1572-103-0x0000000000900000-0x000000000093C000-memory.dmp
memory/1572-172-0x0000000053EA0000-0x0000000053EA1000-memory.dmp
memory/1572-101-0x00000000007E0000-0x00000000007E2000-memory.dmp
memory/1572-94-0x0000000004D90000-0x0000000004DD2000-memory.dmp
memory/1572-180-0x00000000555E0000-0x00000000555E1000-memory.dmp
memory/1572-178-0x00000000555D0000-0x00000000555D1000-memory.dmp
memory/1572-116-0x0000000000D00000-0x0000000000D20000-memory.dmp
memory/3216-51-0x00000000074A0000-0x0000000007536000-memory.dmp
memory/3216-37-0x0000000005C30000-0x0000000005C96000-memory.dmp
memory/3216-35-0x00000000053B0000-0x00000000053D2000-memory.dmp
memory/3216-66-0x0000000007760000-0x000000000777E000-memory.dmp
memory/3216-72-0x0000000007A90000-0x0000000007AAA000-memory.dmp
memory/3216-71-0x0000000007A50000-0x0000000007A64000-memory.dmp
memory/3216-36-0x0000000005BC0000-0x0000000005C26000-memory.dmp
memory/3216-70-0x0000000007A40000-0x0000000007A4E000-memory.dmp
memory/3216-34-0x0000000005520000-0x0000000005B48000-memory.dmp
memory/3216-69-0x0000000007A20000-0x0000000007A31000-memory.dmp
memory/3216-68-0x00000000078A0000-0x00000000078AA000-memory.dmp
memory/3216-56-0x0000000007720000-0x0000000007752000-memory.dmp
memory/3216-50-0x00000000073A0000-0x00000000073BA000-memory.dmp
memory/3216-33-0x0000000002DA0000-0x0000000002DD6000-memory.dmp
memory/3216-73-0x0000000007A80000-0x0000000007A88000-memory.dmp
memory/3216-57-0x00000000703D0000-0x000000007041C000-memory.dmp
memory/3216-53-0x0000000008290000-0x0000000008834000-memory.dmp
memory/3216-52-0x0000000007450000-0x0000000007472000-memory.dmp
memory/3216-67-0x00000000077B0000-0x0000000007853000-memory.dmp
memory/3216-49-0x0000000007C10000-0x000000000828A000-memory.dmp
memory/3216-48-0x0000000006290000-0x00000000062DC000-memory.dmp
memory/3216-47-0x0000000006250000-0x000000000626E000-memory.dmp
memory/3216-58-0x0000000070530000-0x0000000070884000-memory.dmp
memory/3216-45-0x0000000005E60000-0x00000000061B4000-memory.dmp
memory/5656-0-0x000001CFC3F30000-0x000001CFC3F40000-memory.dmp
memory/5656-1-0x000001CFC3F30000-0x000001CFC3F40000-memory.dmp
memory/5656-7-0x000001CFDE6D0000-0x000001CFDE6F2000-memory.dmp