f0ab3c5442d5ecda793d185c9919ef78fa0ec42d900396911375ed197b8e0dd0

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

INC_41153439061US_May_01_2019.js
Size

41KB
MD5

476a24cfb6e724e3fd5b20426102655a
SHA1

0fb08fa676299e39a9cb77fabe3b270f01cddf8b
SHA256

ebd4f543086e069e533320c4c4793117a0684cc46315c929067483a56c8fc478
SHA512

529cfa79989c284c1d6ce73dcc3ce70675757b00e1c636a1fe58c7ea080dc5c3079fece055fd9d08f55f1b79ef52b7d6e4216e199d245d7bf511320d4159f031
SSDEEP

768:9+KIaiKxw5DtPZZvZQkXzO68nOoJD8IdOvTZiNZjNd1T+xovN/d7TUxuNf6rroAD:9+TaiK8G4QgEQJNHlhYbov

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2912	wscript.exe
11	2912	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\INC_41153439061US_May_01_2019.js
1⤵
- Blocklisted process makes network request
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads