d2a7f9508dc4d98fa3eda1937d2f5351d82bb0aad3c39855edfd24e9f816e031

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FILE_59754470130US_Apr_27_2019.js
Size

38KB
MD5

2c255638e9f931532dc429698698fa7b
SHA1

8fbdcbc759c6d373e591bf4d03639e88487b29ae
SHA256

c2c75ef2cf7461733ccfcf2695ca9c2f3609ba27620ca160362ff85cd7d61559
SHA512

0747f55d2494e9ae0811b435b3101ed41b66675e42cbfd1960f07e2dccb03626f815f298d0ccbb2c3b4aaff803f7ae511ac789b9f07caa669f716294d5245d66
SSDEEP

768:vkPYKAKorzXDGDSvSEDmP+wZX2e2W6yz86AnWKWpkVANk6JxN:vkPYKAKorzXDGDSv2+wZG6wNgNDv

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2440	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\FILE_59754470130US_Apr_27_2019.js
1⤵
- Blocklisted process makes network request
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...