d9b36a239b5f7b8320c27431366531a75df564869f36ca0fd815f3679fcdd994

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d32aa58af.js
Size

8KB
MD5

5850bc5ee5891ec3402123ceae69c1c3
SHA1

1ad08a9d91d536aad2a00d38385a9b212278c820
SHA256

b39350590e2515196c3c9272700d370c94a81f654e9e74d04a43666c87b10719
SHA512

fe2b81b13654e48e505d268ede1b0e3ffa114a8320a1f583de38a00595b6e014544baf97b33686cefcae5a34f6b7fb93d31bee1e2569a74c6d02ac814c86a86d
SSDEEP

96:5FtgRYdkNCih5MOUruWhbHyR4Ndb7tfcU6mQz4JrI5C2UV1Pjk9c1hJIszSoMUt6:Z8VNCrOUrukyKqmSYesWoIThnrRcmxb

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

wscript.exe

flow pid process

10 5064 wscript.exe
14 5064 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

flow	pid	process
10	5064	wscript.exe
14	5064	wscript.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\d32aa58af.js
1⤵
- Blocklisted process makes network request
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3184 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads