7460accf81db3640d5f7e1e7b430431adfd687918983e78ecc12a0308f95ec47 | Triage

Analysis

max time kernel
122s
max time network
121s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 05:42

Sharing

Report Analysis Logs

General

Target

7460accf81db3640d5f7e1e7b430431adfd687918983e78ecc12a0308f95ec47.js
Size

29KB
MD5

d34a29506f9838ca335d18156e2fdebd
SHA1

c1ffab611536705707c4d597bec4c25719200567
SHA256

7460accf81db3640d5f7e1e7b430431adfd687918983e78ecc12a0308f95ec47
SHA512

77413597ba2966dc8a3951dfbaeee85bb5407125716d950cf35f28ad8418ca157bf0035bf85691240bc3c0ca1ceeba80fd094eba2d360f5af11c94ddf5518724

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
6	1928	wscript.exe
8	1928	wscript.exe
10	1928	wscript.exe
12	1928	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\7460accf81db3640d5f7e1e7b430431adfd687918983e78ecc12a0308f95ec47.js
1⤵
- Blocklisted process makes network request
PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-55-0x000007FEFC151000-0x000007FEFC153000-memory.dmp

Filesize
8KB

Download