809a1722ed895d072fb9947044188e613039f515ba51ca9944e1de7f9c48d8fc

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:45

Target

Transaction_details_70542962562b60893781355462796092.js
Size

753KB
MD5

d9b9c595ddf9bd1e4df0a7815fc4d0e4
SHA1

ba2ca058a0e0a6b767b366686b983ed5d232b7c4
SHA256

809a1722ed895d072fb9947044188e613039f515ba51ca9944e1de7f9c48d8fc
SHA512

3054b97fc87cb2d3c21d0ffecdd693ea9c2be95f91d4bee89f45ed5d59d6c3a21bfec8045e416888a75f4dcf98d2b58056aa42c0b1f0b32c4f5ff92a315f6d57
SSDEEP

12288:6VQy+sr+KkjWLmZltwQwGsnyd3lP+8xh3EYRfOg/7CCC0HsvQuPnjoohzzgplM+W:6VQy+saKkaLmZltwQwznyd1+8xh3EYRs

Score

8^/10

execution

Blocklisted process makes network request 5 IoCs

Processes:

wscript.exe

flow pid process

24 3056 wscript.exe
41 3056 wscript.exe
54 3056 wscript.exe
57 3056 wscript.exe
73 3056 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Transaction_details_70542962562b60893781355462796092.js
1⤵
- Blocklisted process makes network request
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:2948

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact