625fd6d20dbfe2a46338fc0fdae8c0c341adb60ae5c01debbe329b739099c1d3

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:25

Target

2019_05_PAY_56499789_7289806.js
Size

40KB
MD5

9be0d0053b55c2efc01eec24082fece6
SHA1

2a6766b6331b70377ff0d23fa014b9576aac01e2
SHA256

b4be331a9a01e5ee347770bbd63e1aa54d07febc0e3a7daeb77d171b301a483a
SHA512

a15344e9320e0c4ae67fd53a9583b52aab83225b6d6263524d834943c38ae9d411eca26646c4b263b098a72488c5dd7a8eed6d0420e5a597b688330a99d251d2
SSDEEP

768:2FlL43e/2EA2U2sCCwHF4kgzYtssQxd7GdLFoGB:2DL43KrU2MwHWkgzYtsdd6VB

Score

8^/10

execution

Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

3 3016 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

flow	pid	process
3	3016	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\2019_05_PAY_56499789_7289806.js
1⤵
- Blocklisted process makes network request
PID:3016

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact