4d39059577fd93beecea4444722bbabaaa6493fbb6fa203e8a148a6bfc6fd912

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 05:52

Target

details_0012845321366592,001624571346.js
Size

5.2MB
MD5

fa9a59046f7a3a7fae535ed576f65dc1
SHA1

2eb95dd416ce7410de114e3d87b8879f97427371
SHA256

4d39059577fd93beecea4444722bbabaaa6493fbb6fa203e8a148a6bfc6fd912
SHA512

5baaaa01c5eead81e0bd9a085650f6ec1b6bf06a4ffc9d95bbaddd28a7592930839e7628ce3e67c252ca3e7572b5e54cb2f0a38389db3b72dfc8bc9d57643e32
SSDEEP

49152:kRyEoxk8ekrne54yp3h6Ei+b3rYenInszRnGLW91WiqgiyOzfWZlLufBeGUPrbTp:0

Score

8^/10

Blocklisted process makes network request 5 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\details_0012845321366592,001624571346.js
1⤵
- Blocklisted process makes network request
PID:1400

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact