b2fb41e4af3cd80f10c4748092614c63bfc0822adcbbd9f067c6080dbf0a91c7

Analysis

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

4 1564 WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
4	1564	WScript.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1924 wrote to memory of 1564	1924	WScript.exe	WScript.exe
PID 1924 wrote to memory of 1564	1924	WScript.exe	WScript.exe
PID 1924 wrote to memory of 1564	1924	WScript.exe	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22D1F555S00DF22S1F44AAA5D1S.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Public\E69.vbs"
2⤵
- Blocklisted process makes network request
PID:1564

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Public\E69.vbs
MD5
5aec3639f28abb4748a5677d23d5e9e6

SHA1
8c2aaf57bfa5235c2e45f44f04fc387ef2b1abd9

SHA256
0714fac09f397831033f871b24b9850a72e6833a231e4f207c82c13c59d93945

SHA512
8c6d28e0402acaa40ea762ab6e5763e5994ae8b57f063650e9aa882aa4afdb030102701d45698908022fdf036e2e668075dd9fc6852d1936be469bc3ae38d075

Download Submit
memory/768-3-0x000007FEF6270000-0x000007FEF64EA000-memory.dmp

Filesize
2.5MB

Download
memory/1564-0-0x0000000000000000-mapping.dmp

Download
memory/1564-4-0x00000000025B0000-0x00000000025B4000-memory.dmp

Filesize
16KB

Download
memory/1924-1-0x0000000002650000-0x0000000002654000-memory.dmp

Filesize
16KB

Download