aa50e7bee9ebdb20bdd11b89d996c8fa080337c25a01fdb3d1559cddbe901356

Analysis

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

6 5004 WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

WScript.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings WScript.exe

flow	pid	process
6	5004	WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	WScript.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 4804 wrote to memory of 5004	4804	WScript.exe	WScript.exe
PID 4804 wrote to memory of 5004	4804	WScript.exe	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Public\E69.vbs"
2⤵
- Blocklisted process makes network request
PID:5004

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Public\E69.vbs
MD5
acf4e26d5fa1883fb7f851aa9eee8a56

SHA1
01fcfecd96b50823f247f6de0efcecb5ace304a8

SHA256
9402ff9c33fccb25615d69c04a1982498054266b2d20173d5df47643f1bf720d

SHA512
65f91dc79519dfd34bc73a34755eaa0547a10eec6b1b56b275559e9f6b640f42a0d492985b0c5c62e5d97935d61bf035e4f784f29a35ef83bd0d2de0ed63c8ac

Download Submit
memory/5004-2-0x0000000000000000-mapping.dmp

Download