f8e7f08444f100aba137e61ac4558c4dd4880c1e4792d084e8395b076d8d3bce

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2019_04___REC_818396339735005___5515319530041063523.js
Size

5KB
MD5

99d671ee30cb4a19558f5ae273698ec2
SHA1

3fef1791f40149036f14b13c38a559c7b9b44571
SHA256

ffbe73591031973cb52f6950ed61b168a0f0bda69f004db08846dfc1bd1d1920
SHA512

d419fff8b98adefc5729c4c26e0456345bc7f070e43e4e0b746a94ebd8a0f57cbfce7588a887cd2247b57c3b20a2de07cfe3c417288eb684165123cdb2ab1726
SSDEEP

96:XxzObmpoVuLwUdmACxZgba5NWKjzBFj+2uv4kl7E+20dPL80XI/LgcCgmRwgmO4y:Xxa3VucqmAwZRIKjdql80XI/LgcCgmiC

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
23	724	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\2019_04___REC_818396339735005___5515319530041063523.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ur1sqeo3e.exe

Filesize
4KB

MD5
03b395bba74ae8f4536cfad8f8171ca6

SHA1
edc9edb7e03dd3fe0fe436e8ac4fc60fd8be4586

SHA256
6c8d0e78a23146744ad2b33c97b1d439ef03c9ea2623ff8888a91d0b5bc8283e

SHA512
68669cd6255eb15283a5a17fd75b3dae4f909c4ab861d35e22f681343c3561b608c85274606ceeedefdca9fb0123808ff0a8bfd84e21dbb35494661028a0b01f

Download Submit