73da7ffa3619e3e8afbc2334219f1bd4be18b4128d835e2dfa9db8e3a9e239f5 | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 05:42

Sharing

Report Analysis Logs

General

Target

73da7ffa3619e3e8afbc2334219f1bd4be18b4128d835e2dfa9db8e3a9e239f5.js
Size

26KB
MD5

5e56d42c27affc6c662d1d43b9b4ef1d
SHA1

6ebf6ec3ec7df9003172d2f7d184e57bbeee4a83
SHA256

73da7ffa3619e3e8afbc2334219f1bd4be18b4128d835e2dfa9db8e3a9e239f5
SHA512

9cc9688e1ed5c6497360de986e9a5d9f4f6620d3318705b9d661f56761a5591da321ea569804915ef5844ddf01a1ed8cfd91e63f6d336b98c96ae9a5ecff3bc1

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

wscript.exe

flow pid process

5 1592 wscript.exe
7 1592 wscript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\73da7ffa3619e3e8afbc2334219f1bd4be18b4128d835e2dfa9db8e3a9e239f5.js
1⤵
- Blocklisted process makes network request
PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1592-54-0x000007FEFC501000-0x000007FEFC503000-memory.dmp

Filesize
8KB

Download