bed4824a46537a5e3e88823529ca7dd19e6b5353240eae69605902784578e3de

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 09:12

Target

P-898208403-04272019.js
Size

36KB
MD5

fee53bd7429ac6ff5bfa17d5264364ef
SHA1

9de067074a7d148f10d5ea2044f6a7ff6eb055f7
SHA256

a95b13778f1d7907c0f5e836597f056babe04cf50a24143cbd0227f595c6a9be
SHA512

f3b2003829ccba0d8226ec791b70eb1d67e14bf1a47a5e492689cbda0980b9bf521ce42edbc3161c46abf90f8de4a443d5a50fc0f506c146217c8bfe8a02bd5b
SSDEEP

768:x7crlAXWIx2F8dAmKsB1Z4NKU5Onva9smoWlMchWXoMmKbgL0q+no259QMMsKTuP:x4rlAX5x2F8dRKsBneKU5OnvYJvMchUj

Score

8^/10

execution

Blocklisted process makes network request 7 IoCs

Processes:

wscript.exe

flow pid process

3 1792 wscript.exe
5 1792 wscript.exe
8 1792 wscript.exe
10 1792 wscript.exe
42 1792 wscript.exe
43 1792 wscript.exe
46 1792 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\P-898208403-04272019.js
1⤵
- Blocklisted process makes network request
PID:1792

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance