05baaa5907098d14cf931e05967ca2b6b69ffcf9f4ab25bd1f7969595b29fd92

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 09:55

Target

Rechnung_22386943332DE_April_24_2019.js
Size

46KB
MD5

c29fc956eca8f059f0a619287f86098a
SHA1

30d1daacf3c0f8800d75ce77f650371adf254d69
SHA256

a9066aec7f28a0064831b414f765fc536b4643884a73dab06523ffd2d9cb8f4f
SHA512

7a148e797a60ebd45c34e7419cdd99432144c8af114dac35876f74091db535626889a98f65a827d4cf0afb6ea8c5a8645106303129f65dfa8efa21420e805ec5
SSDEEP

768:ydE36Hfoaz6Cbm8le+b2YUT+klrrF7v1CPbCbxPajpECWw1Ctzo0v+EjHwtjYZTK:l3uQaz6Cbm8le+b2XT+urrVv1sbCbAjH

Score

8^/10

execution

Blocklisted process makes network request 2 IoCs

Processes:

wscript.exe

flow pid process

7 1996 wscript.exe
9 1996 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

flow	pid	process
7	1996	wscript.exe
9	1996	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Rechnung_22386943332DE_April_24_2019.js
1⤵
- Blocklisted process makes network request
PID:1996

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance