f147296f9aeeb6f125d6d772b0a3fd9c7fbd00fc8edacdd858e34aa016140839

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R_826351_04262019.js
Size

29KB
MD5

2b9f698df81d9c09f39bd967f39d7709
SHA1

8435bcab0bcd083c99c7f9d60b35f952fa74394d
SHA256

e11971bb129e8d7af3c1fc7675d3d2eb5fb7828d431969087ee876b78b7dc889
SHA512

562c6b7ae45616e1536f62d359313781dce176a31fd559d115f094f07aaaed3186518277401be955ec82f3f75a82b90435781468276971e7f827630eb35e6ceb
SSDEEP

768:ubn/Lo1ZCTRToP8MCMnKSD/7xIHGD0P2wjAiEjtlN0uHauHhfXT0K7irxxhTcCYx:ub/LozC1M8MCMnh30S3VP7NDF+gjWc

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 6 IoCs

flow	pid	Process
2	760	wscript.exe
20	760	wscript.exe
22	760	wscript.exe
26	760	wscript.exe
27	760	wscript.exe
31	760	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\R_826351_04262019.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jnbypqv6a.exe

Filesize
23KB

MD5
9c4f5cd7db50f80f1fff3974f8cee4fd

SHA1
b237377dd9fa64f2cb9537e3cc7bff884d3f0f8b

SHA256
14bef47007813b948f87966a5962c0b348efecb3535ec7c1f12487d87ceb1f88

SHA512
ae79e4c957b78bbc0afab1d6bc03857ce08c17f95665a5a6477f87c5f37a14e1f864056c22be72ee3d338dd794fa15588ee381a3c13bbcb1ea219678c8e304de

Download Submit