773c9e226e741ab9a8352b55b52ce1e79bca67f8104401515d5719ec271a8ccb

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:19

Target
wsgidav-master/docs/source/davmount.js
Size 3KB
Sample260604-phl2daet5z
SHA256 773c9e226e741ab9a8352b55b52ce1e79bca67f8104401515d5719ec271a8ccb
MD5 7445a623dab55def27f97b4b20811920
SHA1 676f8b035a277b9d3974d3d733d0055c4ea57ed6
SHA512 e26ac425f82fc21b1c56d4c3fd987e75369b97365110807283742861cc8d11b2c64b2707aa18096e2aaf06755d7d648cd2f0e6f4a3f06cb46ac2ab32d6f3c423
TLSH
T1B18152997C5FD52593D8A33B8B7B8085C69FCC3A7168EE6877CDC9C4335881897209B1
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\shell	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\shell\open\command\ = "%SystemRoot%\\system32\\wscript.exe /nologo \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wsgidav-master\\docs\\source\\davmount.js\" \"%1\""	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.davmount	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\DataBase\Content Type\application/davmount+xml	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/davmount+xml\Extension = ".davmount"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\ = "WebDAV Mount Request"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\DefaultIcon\ = "shell32.dll,103"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\shell\open\command	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\shell\open	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.davmount\ = "WebDAV.mount"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.davmount\Content Type = "application/davmount+xml"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\wsgidav-master\docs\source\davmount.js
1⤵
- Modifies registry class
PID:5872

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact