7cb5b62b3c90732c49c25ae8781a67b9eb0e08fc990719082ee588b0d75cd7de

Analysis

max time kernel
55s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2023 17:21

Target

BSN-18504297.js
Size

342KB
MD5

0ee8ea053b9fe7157eabf88cb0c88263
SHA1

9e10f3446b65c59dfb9a3ef4a1b2c9d02e29b59f
SHA256

7cb5b62b3c90732c49c25ae8781a67b9eb0e08fc990719082ee588b0d75cd7de
SHA512

7dc6ad89fa58dd16513b8acc082160450cdb4ae27aa62bb97f5e74577477c7b648497b1877d0446be04ff5e08a74dddf281f91b300a4cb8184f0e035813e4c23
SSDEEP

6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593i:fIS1xbu

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Control Panel\International\Geo\Nation wscript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description pid process target process

PID 3140 wrote to memory of 5108 3140 wscript.exe cmd.exe
PID 3140 wrote to memory of 5108 3140 wscript.exe cmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Control Panel\International\Geo\Nation	wscript.exe

description	pid	process	target process
PID 3140 wrote to memory of 5108	3140	wscript.exe	cmd.exe
PID 3140 wrote to memory of 5108	3140	wscript.exe	cmd.exe

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c mkdir C:\VPNStors\Krosters
2⤵
PID:5108

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact