5578fbc2b70fb9c4a49bfb8b7b6fbe945febee193699fcc9c2aa46675d86f778 | Triage

Analysis

max time kernel
46s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 15:16

Sharing

Report Analysis Logs

General

Target

publish/perfunctorinessRehash.vbs
Size

237B
MD5

f0d4ad5f3317320f8b85d38062a79008
SHA1

0d5a8b8067f68a9cd986502b1448dc040527089e
SHA256

c84838381dfad99dc6e26f0e413a38611feea4e8530abcee1b4260b82076551d
SHA512

934f7a16fb10ae8d57a275ccf12777b8e51cdbf402b3e4a51772ca810de7a442bdc5de6fcc768f04e928e78c78c987a270a26249879a728ff5b59d7f1884693d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\publish\perfunctorinessRehash.vbs"
1⤵
PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-54-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download