3a6b8763626bdb1f75071647e8efeb1623e24c3031beef34cf47ccd28e6fae0a | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 12:21

Sharing

Report Analysis Logs

General

Target

checkbook/derailingEntangling.js
Size

225B
MD5

1e79354e2a3ff1cfc9a45f27a8454d17
SHA1

41480682270fd43f1335cc3ac098c9c34b097b6e
SHA256

4103d7d1c374d49801f1e64418604b15101dd836048e7e005452065894d00622
SHA512

6b1770cfccf392ae90316f749da94a430e96086726142b6a5a4a2f1613c67b4d9d3875b21059f4ff00881a1f2dfce28f7b9ebd762dd757af96059ec285ee38a6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\checkbook\derailingEntangling.js
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download