0dc3a40e9f726f18e3ebac92ee5944d9c12b2ee71252f2b711434c3628877ca1

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 07:22

Target

0dc3a40e9f726f18e3ebac92ee5944d9c12b2ee71252f2b711434c3628877ca1.js
Size

2.6MB
MD5

2a6667f1c14bb04e8e149f416406264b
SHA1

fe92948fecb44112ac77cd35f8537a614b5c2482
SHA256

0dc3a40e9f726f18e3ebac92ee5944d9c12b2ee71252f2b711434c3628877ca1
SHA512

931b64a7f856057781f876cd769a486482a7455038fa52c823339784172decaf1fd5feabbd1a67a65be248f3a881d497e7ae99f33661f2228d827871883f9e16
SSDEEP

49152:6sz6FvpOiHY7sz6FvpOiHYqsz6FvpOiHY7sz6FvpOiHY0:60WQ0Wb0WQ0W5

Score

8^/10

execution

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2028	wscript.exe
4	2028	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\0dc3a40e9f726f18e3ebac92ee5944d9c12b2ee71252f2b711434c3628877ca1.js
1⤵
- Blocklisted process makes network request
PID:2028

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact