393d5e481f3ae653642be73fee229d0e76ad5c76a9ca52f887a7762c4fd0bbc4 | Triage

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 11:59

Sharing

Report Analysis Logs

General

Target

Factura-Janeiro-2145892315-2019-10_25/Factura-Janeiro-2145892315-2019-10_25.vbs
Size

24KB
MD5

bbb4e37dc7a24682f9df59f585d3d39c
SHA1

2a7083c11a32e63d6bab56f735a8b44b3759fafa
SHA256

67508f5f5648be4ef1dcba284592fc1215efdfa90221c01fbda1069a46c956cc
SHA512

6647ea9b16328409c198144be14615983ed89ef9d9243d84a2826fc85b4e4eb72048831d8315e3ccdbc40738d5ecd5249cc718b5bcfbe07fd7847357ca506b33

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

11 2584 WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Factura-Janeiro-2145892315-2019-10_25\Factura-Janeiro-2145892315-2019-10_25.vbs"
1⤵
- Blocklisted process makes network request
PID:2584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads