Analysis
- max time kernel
298s - max time network
299s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 06:06
Static task
static1
Behavioral task
behavioral1
Sample
Receipt_9709210870811215211307465193900690329b.js
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target Receipt_9709210870811215211307465193900690329b.js
- Size 506KB
- Sample260930-gtwe7asgrf
- SHA256 6fc1e45086fbec027e3c95f9fba9df2b565ac5bb4fe10de289f00b6f796cac77
- MD5 10ab6f988fbe0f0f592035ca91f0c7ef
- SHA1 e8b2f9dfa0dc12bfe0a04645f584cb31c46474c5
- SHA512 1b380850b99b4da03e4040bdf3a87072b19c1219a16db84294934b7f5bd7b0b046c20fc8a284e51cd94718f4ebb307b075bf237b68cd23158e3a8a504aa7d83c
- SSDEEP 3072:H8gyewgM2unqLQfOWi7sVbNSd8VvCm+Wtmq0XJKQCz1H8WhNLEmvihXWy/ehRwYY:7E8s/i7Mb0dlR3MTNLEmvyD2hU
- TLSH T191B40C68B54C346BA11A55BA2F3DD9480EBAF9D1313F9043A35077E63F634B86A4843F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 51 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 25 5720 wscript.exe 26 5720 wscript.exe 32 5720 wscript.exe 35 5720 wscript.exe 36 5720 wscript.exe 49 5720 wscript.exe 50 5720 wscript.exe 56 5720 wscript.exe 57 5720 wscript.exe 61 5720 wscript.exe 66 5720 wscript.exe 68 5720 wscript.exe 71 5720 wscript.exe 72 5720 wscript.exe 73 5720 wscript.exe 74 5720 wscript.exe 75 5720 wscript.exe 76 5720 wscript.exe 77 5720 wscript.exe 78 5720 wscript.exe 79 5720 wscript.exe 80 5720 wscript.exe 82 5720 wscript.exe 83 5720 wscript.exe 84 5720 wscript.exe 85 5720 wscript.exe 86 5720 wscript.exe 87 5720 wscript.exe 88 5720 wscript.exe 89 5720 wscript.exe 90 5720 wscript.exe 91 5720 wscript.exe 92 5720 wscript.exe 94 5720 wscript.exe 95 5720 wscript.exe 96 5720 wscript.exe 97 5720 wscript.exe 98 5720 wscript.exe 99 5720 wscript.exe 100 5720 wscript.exe 101 5720 wscript.exe 102 5720 wscript.exe 103 5720 wscript.exe 104 5720 wscript.exe 106 5720 wscript.exe 107 5720 wscript.exe 108 5720 wscript.exe 109 5720 wscript.exe 110 5720 wscript.exe 111 5720 wscript.exe 112 5720 wscript.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wscript.exe