f2ea340a6eaa561e9fa571b190944ba053012f400c0bd82af7ce3d20507e2e2a

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 17:24

Target

fix/consumed.js
Size

132B
MD5

442247b350fdf14d8d5b14723769fddb
SHA1

1c8336b65a320618fb863f3d8c3c9322cce0d0cf
SHA256

17c790ef2945243bcda274f5a2f117efab6faf94fb394fc4fc97e79be0685dda
SHA512

2d121c048c41aee30af107dcf7cb4fff77a2e54707b042339ea349b1fe00a8402fc18d52d5557d89840d04db92ee9681f344ebbe19d96b1489efff7e0f4b93c6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1372 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1372 powershell.exe

pid	process
1372	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1372	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 980 wrote to memory of 1372	980	wscript.exe	powershell.exe
PID 980 wrote to memory of 1372	980	wscript.exe	powershell.exe
PID 980 wrote to memory of 1372	980	wscript.exe	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\fix\consumed.js
1⤵
- Suspicious use of WriteProcessMemory
PID:980

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/980-54-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download
memory/1372-55-0x0000000000000000-mapping.dmp

Download
memory/1372-57-0x000007FEF4480000-0x000007FEF4EA3000-memory.dmp

Filesize
10.1MB

Download
memory/1372-59-0x00000000027A4000-0x00000000027A7000-memory.dmp

Filesize
12KB

Download
memory/1372-58-0x000007FEF3920000-0x000007FEF447D000-memory.dmp

Filesize
11.4MB

Download
memory/1372-60-0x00000000027AB000-0x00000000027CA000-memory.dmp

Filesize
124KB

Download
memory/1372-61-0x00000000027A4000-0x00000000027A7000-memory.dmp

Filesize
12KB

Download
memory/1372-62-0x00000000027AB000-0x00000000027CA000-memory.dmp

Filesize
124KB

Download