00ec8f3900336c7aeb31fef4d111ee6e33f12ad451bc5119d3e50ad80b2212b0

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2023 17:45

Target

Inv(05-19)Copy#17-42-47.js
Size

764KB
MD5

b0a6293b17d888d5bbb00a2eec43bedd
SHA1

72ab1b2ab9e390ea842730aa78ed1d26561fdca2
SHA256

00ec8f3900336c7aeb31fef4d111ee6e33f12ad451bc5119d3e50ad80b2212b0
SHA512

d8c8bf15ab301fa25461a96add2d94fb799220390a358cad31bbd8ad4df41d2ff4f6ccead5129d24b5592cfa3d9230a32394f89318bc53cfe540fc6b27557d51
SSDEEP

12288:qo3Npw3bC42p8hQbShsCO8j5o08jGd963H+Y5a5zn75H5ZC5aerQM+ZzFWX8lLG2:qo3nIApkQbSX5jS08qdkn5azn715ZC58

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	4708	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Inv(05-19)Copy#17-42-47.js
1⤵
- Blocklisted process makes network request
PID:4708

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact