af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

Analysis

max time kernel
53s
max time network
61s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
23-03-2023 00:49

Target

af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e.wsf
Size

61KB
MD5

45282862aeb428ffb5d4986704a8f4d5
SHA1

fa2b0a82f3ca6bc7c00704556c9494b303613972
SHA256

af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e
SHA512

db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db
SSDEEP

768:6hKs7p4MAPEQbhh/8avllsFEaN3K19Z5zkzCIi5:6L7p4MafVLYEaN3K19ZWzCn5

Score

8^/10

Blocklisted process makes network request 12 IoCs

Processes:

WScript.exe

Script User-Agent 12 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	12	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	16	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e.wsf"
1⤵
- Blocklisted process makes network request
PID:3000

C:\Users\Admin\AppData\Local\Temp\radD69D8.tmp.dll

Filesize
10B

MD5
7605968e79d0ca095ab1231486d2b814

SHA1
a007b420d19ceefa840f0373e050e3b51a4ab480

SHA256
493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b

SHA512
769249da7ed6c6bf5671bbc2371a6453b433226ceb8c4c2aa3604000d66647bcec83dee1ab64c0262fa40f923d77e23bad2c47274d339effc51d904ce77072a6

Download Submit