cd35b4fffe82c7e263a990b8aaaaadfdbcc804241661fdfb05fafb9013f5ac9a | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 10:15

Sharing

Report Analysis Logs

General

Target

publish/popperSumatra.vbs
Size

223B
MD5

15100bb30ab62ee4f1bd10d037bc8993
SHA1

2ed53c6db74192a54e7c1697dae370873386af99
SHA256

eba01229a86c02f77bf78ac929d30b5afc536c42220b745a1602dc7a090d06fd
SHA512

7fc5f02ad147ffcf40392137afbd22a7f05bf6d1cab82926488baa5fbeff8b46924ad2a218ef3fc91bc23be3a181a8e7c1f0aea150237fc8a0db19d9a5d8e562

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\publish\popperSumatra.vbs"
1⤵
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-54-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download