2c18f5b275f6eaf07970994914ceafb634067e0fea2896dd07f10350010ec5e0

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wsgidav-master/docs/source/registerWindowsDavMount.bat
Size 21B
Sample260604-phl2daet5z
SHA256 2c18f5b275f6eaf07970994914ceafb634067e0fea2896dd07f10350010ec5e0
MD5 41b5684684f31fcd4c1026d917822c23
SHA1 8b80c1cab3c88f08c96e7699bb3c16448ab91371
SHA512 5b1712d684b064bae7b8023ebf11f71748e8a0c9c43b82d837080974e1eb311c2b395fedf412f1d418d03b2d6989a95e33b39148af2d6be5308100e42b2e7148
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/davmount+xml\Extension = ".davmount"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\shell\open\command\ = "%SystemRoot%\\system32\\wscript.exe /nologo \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wsgidav-master\\docs\\source\\davmount.js\" \"%1\""	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\DataBase\Content Type\application/davmount+xml	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\ = "WebDAV Mount Request"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\DefaultIcon\ = "shell32.dll,103"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\shell\open\command	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\shell	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebDAV.mount\shell\open	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.davmount	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.davmount\ = "WebDAV.mount"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.davmount\Content Type = "application/davmount+xml"	wscript.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 4164	4008	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wsgidav-master\docs\source\registerWindowsDavMount.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\system32\wscript.exe
  wscript davmount.js
  2⤵
  - Modifies registry class
  PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads