043df4e99aeaa6f5873b0cf3dec2694d5b8d1f4830b37c9e2a5fc16953baccf5

Analysis

max time kernel
30s
max time network
31s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 11:25

Target

043df4e99aeaa6f5873b0cf3dec2694d5b8d1f4830b37c9e2a5fc16953baccf5.js
Size

616KB
MD5

67ae1f3636df193b2b7897bc536fcf76
SHA1

f3a94059adecc0de3615ebe2fb7df65599b3361b
SHA256

043df4e99aeaa6f5873b0cf3dec2694d5b8d1f4830b37c9e2a5fc16953baccf5
SHA512

2c0e76588a79f88036d51a4e628bf8120ca36a3c788b5066004955e0c2be855aa8b5ee357e9b2332d5957ce3c6da23d63539fa0eb730596e08a3574a180093c1
SSDEEP

12288:MYeIrWr/qRigAyX/kngXFbjTLvaH28nZH19Iimg0VtxWvTbxzOObcizI/mofdEMZ:MYeIrWr/qRigAyX/kngXFbjTLvaH28n8

Score

8^/10

execution

Blocklisted process makes network request 4 IoCs

Processes:

wscript.exe

flow pid process

4 1508 wscript.exe
7 1508 wscript.exe
9 1508 wscript.exe
10 1508 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\043df4e99aeaa6f5873b0cf3dec2694d5b8d1f4830b37c9e2a5fc16953baccf5.js
1⤵
- Blocklisted process makes network request
PID:1508

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact