Analysis

  • max time kernel
    96s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-06-2023 17:08

General

  • Target

    gui/script.js

  • Size

    2KB

  • MD5

    ef7730a96c61a4ab85e03c9dd6bd63d5

  • SHA1

    434a065c0d4a126984a3e09513a364bb6ffa40e7

  • SHA256

    9aca0357bf142b1ecd70af9f994639cb92af52de396267178fa1d672ca20e4b4

  • SHA512

    90aff01e609cde790aaa19ca72cd13ce58c8f4b87e022d570d171f1911bb5c1d209ebd5a6bf2b560a877276bc9fc9be07f1420a8f446c37dc05c55246ad65c1d

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\gui\script.js
    1⤵
      PID:1324

    Network

    • flag-nl
      GET
      http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl
      Remote address:
      173.223.113.131:80
      Request
      GET /pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: www.microsoft.com
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      241.150.49.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.150.49.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      76.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      76.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.232.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.232.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.104.205.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.104.205.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      76.38.195.152.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      76.38.195.152.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      44.8.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      44.8.109.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      133.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      134.121.24.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      134.121.24.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      76.121.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      76.121.18.2.in-addr.arpa
      IN PTR
      Response
      76.121.18.2.in-addr.arpa
      IN PTR
      a2-18-121-76deploystaticakamaitechnologiescom
    • 173.223.113.131:80
      http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl
      http
      216 B
      40 B
      1
      1

      HTTP Request

      GET http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl
    • 20.234.34.18:443
      322 B
      7
    • 20.234.34.18:443
      156 B
      3
    • 20.40.136.238:443
      tls, https
      6.2kB
      8
    • 20.40.136.238:443
      46 B
      1
    • 52.182.143.210:443
      322 B
      7
    • 209.197.3.8:80
      322 B
      7
    • 209.197.3.8:80
      322 B
      7
    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      241.150.49.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      241.150.49.20.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      76.32.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      76.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      240.232.229.192.in-addr.arpa
      dns
      74 B
      145 B
      1
      1

      DNS Request

      240.232.229.192.in-addr.arpa

    • 8.8.8.8:53
      58.104.205.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      58.104.205.20.in-addr.arpa

    • 8.8.8.8:53
      76.38.195.152.in-addr.arpa
      dns
      72 B
      143 B
      1
      1

      DNS Request

      76.38.195.152.in-addr.arpa

    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      44.8.109.52.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      44.8.109.52.in-addr.arpa

    • 8.8.8.8:53
      133.32.126.40.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      133.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      134.121.24.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      134.121.24.20.in-addr.arpa

    • 8.8.8.8:53
      76.121.18.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      76.121.18.2.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.