Analysis
-
max time kernel
299s -
max time network
327s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
30-06-2024 23:36
General
-
Target
Source/QtQuick/Controls/Styles/Desktop/TreeViewStyle.js
-
Size
2KB
-
MD5
e0aa379b2a0c01ba02d9dd128c74bfbb
-
SHA1
4e2005633527069eede98c33628428c358ce0c64
-
SHA256
1c645cda72e81f295d03fed5142c502651c9d5f0418788f5f3c53a5720c2351e
-
SHA512
28bf0f38bd956458655590f2abddc0a14ab80cd395f18b710c0c9e973ee1c033615302c94d0bb4906d711e82880db0239c3c81ea36845d8d882e1d38a1ee3502
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Source\QtQuick\Controls\Styles\Desktop\TreeViewStyle.js1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage