7b6e6e0e4588f5bd63bc70c4088ef21f772cb1544e75071eaf8d1094ecfcf56c

Analysis

max time kernel
130s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 04:37

Target

Z_6148557_04262019.js
Size

29KB
MD5

0ab9ecf40a20d9138df175217e2b59e5
SHA1

b194c983c78e23f417e145210471179190b5f0cd
SHA256

f49b59f066266e3221f9a73108d13447ae21166858233d7c50c54ad6dd9d1fe0
SHA512

d96c91a4a7c9dd7d440b474e92a516d8d46a8ed61b8baf21fbf248b00c3dfca2432cebc898ba080a6b55d07cb676f8902bc4dae5a61233bee26af2133caa93ce
SSDEEP

768:nu6eyZCR3pL62RezD/C6nvaSJ77NVszk/huoOvSSxMlOzux2B/mlmgpu0ofo5HER:nHeyIRmDL8l45oKG

Score

8^/10

execution

Blocklisted process makes network request 7 IoCs

Processes:

wscript.exe

flow pid process

7 1280 wscript.exe
9 1280 wscript.exe
11 1280 wscript.exe
13 1280 wscript.exe
24 1280 wscript.exe
28 1280 wscript.exe
36 1280 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Z_6148557_04262019.js
1⤵
- Blocklisted process makes network request
PID:1280

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact