e827485eb08bbb0f03efa7ed63ea786b74d3b4d46f2188e4b4210b1e9df6bb7a | Triage

Analysis

max time kernel
144s
max time network
151s
platform
windows10_x64
resource
win10v20210410
submitted
21-07-2021 21:00

Sharing

Report Analysis Logs

General

Target

bcgeu_collective_agreement_lifelabs.js
Size

2KB
MD5

dcfc4a2c09049b61c9fcbadcb42c9e46
SHA1

1abb833aedc660f05bd2e69202f48191390aac26
SHA256

cc7d78e7bd8863cb7dd920eb6c79a95da1b07693fea683f95289a15bbaaeacc0
SHA512

5f7135c400e3e041898c5f4f315d5490b6a6aae37337def3e20d132a3d892fb216ebe1b6d5f7a9be210a27a8dedbcc2b9996dc615149fd58a6771db892b5b9cf

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

wscript.exe

flow pid process

16 4048 wscript.exe
18 4048 wscript.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	16	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\bcgeu_collective_agreement_lifelabs.js
1⤵
- Blocklisted process makes network request
PID:4048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...