ea3e2f6f3a08ba3d46c9cd1c9fc8ae7d3f4d83119e99d300d8ecc2ae45f92da0

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Document_140005193005US_Apr_24_2019.js
Size

46KB
MD5

c29fc956eca8f059f0a619287f86098a
SHA1

30d1daacf3c0f8800d75ce77f650371adf254d69
SHA256

a9066aec7f28a0064831b414f765fc536b4643884a73dab06523ffd2d9cb8f4f
SHA512

7a148e797a60ebd45c34e7419cdd99432144c8af114dac35876f74091db535626889a98f65a827d4cf0afb6ea8c5a8645106303129f65dfa8efa21420e805ec5
SSDEEP

768:ydE36Hfoaz6Cbm8le+b2YUT+klrrF7v1CPbCbxPajpECWw1Ctzo0v+EjHwtjYZTK:l3uQaz6Cbm8le+b2XT+urrVv1sbCbAjH

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2328	wscript.exe
7	2328	wscript.exe
10	2328	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Document_140005193005US_Apr_24_2019.js
1⤵
- Blocklisted process makes network request
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...