05baaa5907098d14cf931e05967ca2b6b69ffcf9f4ab25bd1f7969595b29fd92

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 09:55

Target

Rechnung_22386943332DE_April_24_2019.js
Size

46KB
MD5

c29fc956eca8f059f0a619287f86098a
SHA1

30d1daacf3c0f8800d75ce77f650371adf254d69
SHA256

a9066aec7f28a0064831b414f765fc536b4643884a73dab06523ffd2d9cb8f4f
SHA512

7a148e797a60ebd45c34e7419cdd99432144c8af114dac35876f74091db535626889a98f65a827d4cf0afb6ea8c5a8645106303129f65dfa8efa21420e805ec5
SSDEEP

768:ydE36Hfoaz6Cbm8le+b2YUT+klrrF7v1CPbCbxPajpECWw1Ctzo0v+EjHwtjYZTK:l3uQaz6Cbm8le+b2XT+urrVv1sbCbAjH

Score

8^/10

execution

Blocklisted process makes network request 2 IoCs

Processes:

wscript.exe

flow pid process

4 4580 wscript.exe
10 4580 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

flow	pid	process
4	4580	wscript.exe
10	4580	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Rechnung_22386943332DE_April_24_2019.js
1⤵
- Blocklisted process makes network request
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4208,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
1⤵
PID:2172

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance