eed01ced086890e690dbee6e4b789451d58941deff069a1224a1fb3edaca879c

Resubmissions

20-08-2024 14:55

240820-sad8casbpm 8

20-08-2024 14:52

240820-r87rwasbkp 10

Analysis

max time kernel
19s
max time network
23s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Device/HarddiskVolume3/Users/radam/Downloads/Update.js
Size

3.9MB
MD5

8f22f69f3f1b78150451a3f4e6127787
SHA1

9af226a7410e52e4c0d9d1b6417e1d9217a26461
SHA256

bf4509b05dc7975a46ca8325e860371446ff6482ebea271c804ad1892058a8c2
SHA512

dcdf0f9cd32d892e14c1cf96261715e7853bca2d4ea44e3f3ae00ab34a33fbdac622cf9ad4ba6578e245cda50f5f6259db7a7635892f13fbc2ae1f970ec617e3
SSDEEP

49152:6sz6FvpOiHY7sz6FvpOiHYXsz6FvpOiHY7sz6FvpOiHYVsz6FvpOiHY7sz6FvpOQ:60WQ0Ws0WQ0WQ0WQ0W5

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2192	wscript.exe
4	2192	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Users\radam\Downloads\Update.js
1⤵
- Blocklisted process makes network request
PID:2192

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads