0682e4f0338df0af30a545bf33a8866545490bc3372e19568358bba58933a145

Analysis

max time kernel
136s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 08:33

Target

af988030zdi23585.cmdk7on9i.jse
Size

704KB
MD5

8f9e3c4603c839de3f0e020aef14ec86
SHA1

91e19015bf8b0527569961b17a3674fad4e1363a
SHA256

0682e4f0338df0af30a545bf33a8866545490bc3372e19568358bba58933a145
SHA512

ac3327765a58e40513f7d8b1bcf2842171e13290d924817a07764682d639bcfe08bf684cb306f714383050d396bc1054603880ab4203f1985e17c6ef42673b6c
SSDEEP

12288:awh0+8h0+iRT3Fhh0+uh0+Ih0+Vh0+Mh0+6h0+xh0+th0+9h0+xcnnhcLG2:awh0+8h0+wT3Fhh0+uh0+Ih0+Vh0+Mhg

Score

8^/10

Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

17 4616 WScript.exe
33 4616 WScript.exe
38 4616 WScript.exe
39 4616 WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\af988030zdi23585.cmdk7on9i.jse"
1⤵
- Blocklisted process makes network request
PID:4616

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact