f0ab3c5442d5ecda793d185c9919ef78fa0ec42d900396911375ed197b8e0dd0

Analysis

max time kernel
135s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INC_41153439061US_May_01_2019.js
Size

41KB
MD5

476a24cfb6e724e3fd5b20426102655a
SHA1

0fb08fa676299e39a9cb77fabe3b270f01cddf8b
SHA256

ebd4f543086e069e533320c4c4793117a0684cc46315c929067483a56c8fc478
SHA512

529cfa79989c284c1d6ce73dcc3ce70675757b00e1c636a1fe58c7ea080dc5c3079fece055fd9d08f55f1b79ef52b7d6e4216e199d245d7bf511320d4159f031
SSDEEP

768:9+KIaiKxw5DtPZZvZQkXzO68nOoJD8IdOvTZiNZjNd1T+xovN/d7TUxuNf6rroAD:9+TaiK8G4QgEQJNHlhYbov

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	3064	wscript.exe
23	3064	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\INC_41153439061US_May_01_2019.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1lijb5l31.exe

Filesize
496B

MD5
1842eed13fddc700a50adada08a0f84d

SHA1
5e7b6997ffaf89afdb803de2e9231cd8886621ae

SHA256
47ac9eef48022403111f9cef6871af594079acdd88da83e7d2b2a92fa47f7368

SHA512
0d0086367e60782f81324abc5a79ae4c19aaa96aeb7aead23d4ca2dde0af5cc7cf3cc9b6e391b95405ed97a136fcd99af3f868a6027b89b5fcc47cff52272b1d

Download Submit