Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
06/10/2026, 07:56
General
- Target PRE-ALERT HCC2025122601.js
- Size 689KB
- Sample261006-jsx9hatdrd
- SHA256 51629d832832833363650fee28d130f0299c65bbe9f00b1a7be1cd91e3f3e33e
Malware Config
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\PRE-ALERT HCC2025122601.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ODEKUQJF))2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\96352266770314.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\96352266770314.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZZBFSMX))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZZBFSMX))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZZBFSMX))"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\system32\choice.exe"5⤵
-
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\96352266770314.cmd"3⤵
- Views/modifies file attributes
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
96352266770314.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_dgnigbqx.tvk.ps1
handoff_dbg_2256_e59014e.txt
handoff_dbg_2256_e59014e.txt
memory/216-295-0x00000000056A0000-0x0000000005732000-memory.dmp
memory/216-297-0x0000000005790000-0x000000000579A000-memory.dmp
memory/216-490-0x0000000000A00000-0x0000000000A0A000-memory.dmp
memory/216-361-0x00000000021C0000-0x00000000021C1000-memory.dmp
memory/216-362-0x00000000021D0000-0x00000000021D1000-memory.dmp
memory/216-363-0x00000000021E0000-0x00000000021F0000-memory.dmp
memory/216-385-0x00000000024E0000-0x00000000024F0000-memory.dmp
memory/216-393-0x00000000048C0000-0x00000000048D0000-memory.dmp
memory/216-418-0x0000000004C20000-0x0000000004C30000-memory.dmp
memory/216-420-0x0000000004C30000-0x0000000004C40000-memory.dmp
memory/216-421-0x0000000004C40000-0x0000000004C50000-memory.dmp
memory/216-438-0x0000000005600000-0x0000000005610000-memory.dmp
memory/216-439-0x0000000005610000-0x0000000005620000-memory.dmp
memory/216-440-0x0000000005620000-0x0000000005630000-memory.dmp
memory/216-444-0x0000000005660000-0x0000000005661000-memory.dmp
memory/216-463-0x00000000548B0000-0x00000000548B1000-memory.dmp
memory/216-465-0x00000000548C0000-0x00000000548C1000-memory.dmp
memory/216-469-0x00000000548E0000-0x00000000548E1000-memory.dmp
memory/216-471-0x00000000548F0000-0x00000000548F1000-memory.dmp
memory/216-394-0x00000000048D0000-0x00000000048E0000-memory.dmp
memory/216-312-0x0000000000490000-0x00000000004A0000-memory.dmp
memory/216-164-0x0000000010000000-0x0000000010040000-memory.dmp
memory/216-296-0x0000000005740000-0x0000000005790000-memory.dmp
memory/216-75-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/216-76-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/216-79-0x0000000010000000-0x0000000010040000-memory.dmp
memory/216-92-0x0000000000770000-0x0000000000790000-memory.dmp
memory/216-140-0x00000000021C0000-0x00000000021C1000-memory.dmp
memory/216-141-0x00000000021D0000-0x00000000021D1000-memory.dmp
memory/216-201-0x0000000000490000-0x00000000004A0000-memory.dmp
memory/216-247-0x00000000021F0000-0x0000000002200000-memory.dmp
memory/216-180-0x0000000055720000-0x0000000055721000-memory.dmp
memory/216-178-0x0000000055710000-0x0000000055711000-memory.dmp
memory/216-174-0x0000000053DF0000-0x0000000053DF1000-memory.dmp
memory/216-172-0x0000000053DE0000-0x0000000053DE1000-memory.dmp
memory/216-170-0x0000000053DD0000-0x0000000053DD1000-memory.dmp
memory/216-90-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/216-122-0x0000000000790000-0x00000000007D0000-memory.dmp
memory/216-144-0x00000000021F0000-0x0000000002200000-memory.dmp
memory/216-120-0x0000000000770000-0x0000000000790000-memory.dmp
memory/216-119-0x0000000000770000-0x0000000000790000-memory.dmp
memory/216-118-0x0000000000730000-0x000000000076C000-memory.dmp
memory/216-110-0x0000000000490000-0x00000000004A0000-memory.dmp
memory/216-106-0x0000000000400000-0x0000000000450000-memory.dmp
memory/216-96-0x00000000023E0000-0x0000000002422000-memory.dmp
memory/216-105-0x00000000001B0000-0x00000000001EC000-memory.dmp
memory/216-102-0x0000000000120000-0x0000000000122000-memory.dmp
memory/1716-0-0x000001B8E83B0000-0x000001B8E83C0000-memory.dmp
memory/1716-1-0x000001B8E83B0000-0x000001B8E83C0000-memory.dmp
memory/1716-9-0x000001B8EAB30000-0x000001B8EAB52000-memory.dmp
memory/2256-51-0x0000000006EA0000-0x0000000006F36000-memory.dmp
memory/2256-33-0x00000000047A0000-0x00000000047D6000-memory.dmp
memory/2256-72-0x00000000074B0000-0x00000000074CA000-memory.dmp
memory/2256-35-0x0000000004DA0000-0x0000000004DC2000-memory.dmp
memory/2256-73-0x00000000074A0000-0x00000000074A8000-memory.dmp
memory/2256-70-0x0000000007460000-0x000000000746E000-memory.dmp
memory/2256-69-0x00000000022F0000-0x0000000002301000-memory.dmp
memory/2256-56-0x0000000007150000-0x0000000007182000-memory.dmp
memory/2256-57-0x0000000070310000-0x000000007035C000-memory.dmp
memory/2256-68-0x00000000072A0000-0x00000000072AA000-memory.dmp
memory/2256-34-0x0000000004F30000-0x0000000005558000-memory.dmp
memory/2256-66-0x0000000007110000-0x000000000712E000-memory.dmp
memory/2256-67-0x0000000007190000-0x0000000007233000-memory.dmp
memory/2256-71-0x0000000007470000-0x0000000007484000-memory.dmp
memory/2256-53-0x0000000007C70000-0x0000000008214000-memory.dmp
memory/2256-58-0x00000000706F0000-0x0000000070A44000-memory.dmp
memory/2256-52-0x0000000006E50000-0x0000000006E72000-memory.dmp
memory/2256-49-0x00000000075F0000-0x0000000007C6A000-memory.dmp
memory/2256-50-0x00000000061B0000-0x00000000061CA000-memory.dmp
memory/2256-47-0x00000000061E0000-0x000000000622C000-memory.dmp
memory/2256-46-0x0000000005C50000-0x0000000005C6E000-memory.dmp
memory/2256-44-0x00000000056B0000-0x0000000005A04000-memory.dmp
memory/2256-37-0x0000000005640000-0x00000000056A6000-memory.dmp
memory/2256-36-0x00000000055D0000-0x0000000005636000-memory.dmp
memory/3424-74-0x0000000000A00000-0x0000000000A0A000-memory.dmp