8af6f8cc8843ecd22c08ceeddea6f6a0081427b64c61ac6946e2ef47578ce5de

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 12:03

Target

E_0714551_04262019.js
Size

29KB
MD5

0ab9ecf40a20d9138df175217e2b59e5
SHA1

b194c983c78e23f417e145210471179190b5f0cd
SHA256

f49b59f066266e3221f9a73108d13447ae21166858233d7c50c54ad6dd9d1fe0
SHA512

d96c91a4a7c9dd7d440b474e92a516d8d46a8ed61b8baf21fbf248b00c3dfca2432cebc898ba080a6b55d07cb676f8902bc4dae5a61233bee26af2133caa93ce
SSDEEP

768:nu6eyZCR3pL62RezD/C6nvaSJ77NVszk/huoOvSSxMlOzux2B/mlmgpu0ofo5HER:nHeyIRmDL8l45oKG

Score

8^/10

execution

Blocklisted process makes network request 7 IoCs

Processes:

wscript.exe

flow pid process

4 2468 wscript.exe
7 2468 wscript.exe
9 2468 wscript.exe
11 2468 wscript.exe
18 2468 wscript.exe
19 2468 wscript.exe
23 2468 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\E_0714551_04262019.js
1⤵
- Blocklisted process makes network request
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3872

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact