Analysis
- max time kernel
298s - max time network
303s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 06:06
Static task
static1
Behavioral task
behavioral1
Sample
Receipt_9709210870811215211307465193900690329b.js
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target Receipt_9709210870811215211307465193900690329b.js
- Size 506KB
- Sample260930-gtwe7asgrf
- SHA256 6fc1e45086fbec027e3c95f9fba9df2b565ac5bb4fe10de289f00b6f796cac77
- MD5 10ab6f988fbe0f0f592035ca91f0c7ef
- SHA1 e8b2f9dfa0dc12bfe0a04645f584cb31c46474c5
- SHA512 1b380850b99b4da03e4040bdf3a87072b19c1219a16db84294934b7f5bd7b0b046c20fc8a284e51cd94718f4ebb307b075bf237b68cd23158e3a8a504aa7d83c
- SSDEEP 3072:H8gyewgM2unqLQfOWi7sVbNSd8VvCm+Wtmq0XJKQCz1H8WhNLEmvihXWy/ehRwYY:7E8s/i7Mb0dlR3MTNLEmvyD2hU
- TLSH T191B40C68B54C346BA11A55BA2F3DD9480EBAF9D1313F9043A35077E63F634B86A4843F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 50 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 4632 wscript.exe 9 4632 wscript.exe 10 4632 wscript.exe 11 4632 wscript.exe 12 4632 wscript.exe 13 4632 wscript.exe 14 4632 wscript.exe 15 4632 wscript.exe 17 4632 wscript.exe 18 4632 wscript.exe 19 4632 wscript.exe 20 4632 wscript.exe 21 4632 wscript.exe 22 4632 wscript.exe 23 4632 wscript.exe 24 4632 wscript.exe 25 4632 wscript.exe 26 4632 wscript.exe 27 4632 wscript.exe 28 4632 wscript.exe 29 4632 wscript.exe 30 4632 wscript.exe 31 4632 wscript.exe 32 4632 wscript.exe 33 4632 wscript.exe 34 4632 wscript.exe 35 4632 wscript.exe 36 4632 wscript.exe 37 4632 wscript.exe 38 4632 wscript.exe 39 4632 wscript.exe 40 4632 wscript.exe 41 4632 wscript.exe 42 4632 wscript.exe 43 4632 wscript.exe 44 4632 wscript.exe 45 4632 wscript.exe 46 4632 wscript.exe 47 4632 wscript.exe 48 4632 wscript.exe 49 4632 wscript.exe 50 4632 wscript.exe 51 4632 wscript.exe 52 4632 wscript.exe 53 4632 wscript.exe 54 4632 wscript.exe 55 4632 wscript.exe 56 4632 wscript.exe 57 4632 wscript.exe 58 4632 wscript.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wscript.exe