Windows Endpoint Compromised by Sophisticated Malware Using Advanced Evasion Techniques

Initial Signal

SentinelOne detected a malicious JavaScript file `[CUSTOM_DIR_2].js` (SHA256: 971d9ee3bee06292fa255e169dfb10b4a4644819cd774562198f7e178eb79ad4) executing on Windows 11 laptop ws-001 belonging to user_1. The detection maps to MITRE technique T1547.001 (Registry Run Keys / Startup Folder), though the actual attack chain demonstrates broader evasion capabilities. The specific artifact that triggered investigation was a multi-stage execution chain: wscript.exe launched the JavaScript file, which spawned `[CUSTOM_DIR_2].com`, which then created and executed `RegAsm.exe` in non-standard locations within the user's AppData directory. What made this signal significant was not just the presence of these processes, but the behavioral indicators accompanying them—process hollowing, function unhooking, and remote memory allocation—all hallmarks of deliberate adversarial evasion rather than legitimate application behavior. SentinelOne's behavioral analysis identified 13 related threat events within the execution chain, revealing a coordinated attack designed to bypass endpoint detection. The investigation correlated data from SentinelOne, IPData, VirusTotal, and Microsoft Entra ID across 47 invocations, completing autonomous analysis in 4m 50s and establishing a clear timeline of compromise.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. fp1
   Verified the malicious nature of the execution chain from wscript.exe to [CUSTOM_DIR_2].js to [CUSTOM_DIR_2].com to RegAsm.exe in non-standard locations
   Pass
2. fp2
   Analyzed the behavioral indicators for legitimate explanations
   Pass
3. fp3
   Evaluated whether the activity could be explained by legitimate software
   Pass
4. fp4
   Checked for system maintenance or updates that could explain the behavior
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Compromised at high confidence rests on the following mutually corroborating signals:

1. SentinelOne detected a malicious JavaScript file with a specific SHA256 hash (971d9ee3bee06292fa255e169dfb10b4a4644819cd774562198f7e178eb79ad4) executing on the endpoint, confirmed through multiple threat event records showing the file's presence and execution context

2. A complete multi-stage execution chain was reconstructed from wscript.exe → JavaScript file → [CUSTOM_DIR_2].com → RegAsm.exe, with each stage documented in SentinelOne's process telemetry and threat event logs

3. Advanced evasion techniques including process hollowing, function unhooking, and remote memory allocation were detected as behavioral indicators, techniques that are rarely present in legitimate software and are characteristic of sophisticated malware

4. The malware copied legitimate Windows utilities (RegAsm.exe) to non-standard locations (C:\Users\user_1\AppData\Local\[CUSTOM_DIR_1]\), a living-off-the-land technique used to evade file-based detection

5. No contradictory evidence emerged from Microsoft Entra ID sign-in logs, VirusTotal reputation checks, or IPData geolocation analysis that would suggest a false positive or benign explanation. The confidence is High rather than Confirmed because the SentinelOne agent is marked as pending uninstallation, which could affect ongoing monitoring and remediation capabilities if not addressed immediately

Lessons

1. 01
   Pending uninstallation status masks active compromise. In this investigation, the SentinelOne agent was marked for pending uninstallation while actively detecting and reporting malware. The agent remained functional and generated 13 threat events documenting the attack chain. However, if the uninstallation had proceeded before remediation, the endpoint would have lost all endpoint detection and response capabilities mid-incident. Always verify the status and timeline of agent uninstallations against active threat detections. Ensure remediation is complete before removing security tooling.
2. 02
   Small file size does not indicate benign intent. The malicious JavaScript file [CUSTOM_DIR_2].js was only 180 bytes, yet it successfully initiated a multi-stage attack chain involving process hollowing and memory injection. Attackers often minimize file size to evade file-based detection and reduce storage footprint. Do not dismiss small scripts as harmless; correlate file size with execution context, parent process, and behavioral indicators like memory operations and process creation.
3. 03
   Legitimate binary location is the strongest detection signal. RegAsm.exe executing from C:\Users\user_1\AppData\Local\[CUSTOM_DIR_1]\ was the clearest indicator of compromise in this chain. System utilities copied to user directories almost never occur in legitimate scenarios. Implement detection rules that flag execution of known Windows binaries from paths outside their standard System32 or Program Files locations, regardless of digital signature status.
4. 04
   Behavioral indicators matter more than file reputation. The malware's file hash had no VirusTotal detections at the time of analysis, yet SentinelOne's behavioral detection identified process hollowing, function unhooking, and remote memory allocation—all malicious indicators. File reputation systems lag behind sophisticated malware. Prioritize behavioral analysis and process chain reconstruction over hash-based verdicts when investigating suspicious execution.
5. 05
   Absence of cloud sign-in activity does not rule out compromise. Microsoft Entra ID logs showed no suspicious sign-in activity from the malware's originating IP address, which initially appeared to exonerate the endpoint. However, the endpoint itself was clearly compromised. Malware may not immediately attempt cloud credential theft or lateral movement. Investigate endpoint compromise independently of cloud authentication logs; they answer different questions about the scope of an incident.