39af6a44ee545ea15eaf3151ec22adb0882ff0fdd2583bc94fcb8c41f51cb931

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 08:32

Target

af988030.srcoop.jse
Size

610KB
MD5

9897f516b9486c1026e984d3d03fab7f
SHA1

7e8141acb01d6468381ff7c40239318d6a764298
SHA256

39af6a44ee545ea15eaf3151ec22adb0882ff0fdd2583bc94fcb8c41f51cb931
SHA512

ef92512a0988fdd847063f5c4445ceb7c3417cf9c3c8c2e7604f932237bedb9b22dc8a108d916fcfa59f48eef3561ca059bcfbab803dd7a7479ce8a2f4847990
SSDEEP

12288:ZV3WkJb+ngO+ng33Wkp+ngCJ+ngB5sgmJg0rPtl+ngaoQuu:ZV3Wk5+ngO+ng33Wkp+ng0+ngV0n+ngo

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

38 4888 WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
38	4888	WScript.exe

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\af988030.srcoop.jse"
1⤵
- Blocklisted process makes network request
PID:4888

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact