ecf100317748982479f8f8d5480b337bd8027141facc05e7230aa70c1acb70b0 | Triage

Analysis

max time kernel
71s
max time network
73s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/05/2023, 17:03

Sharing

Report Analysis Logs

General

Target

Claim_C736.wsf
Size

60KB
MD5

ab56f73616cb46052b1216a5215a0b04
SHA1

a8a47d321dbd6b768d1d4dab7480ac6b947c1600
SHA256

21655aa8370b5541fbaebb6b02da5eb294eaf82066ab42889b8df15a709fb5c3
SHA512

378b54053f6e0fea6205952920a281b2769e7ad135c8b933f34a845511312277734afe940f1210b8e009cc1e2ebbda8de191ac53f3d1c1d75ef45241fb6887bd
SSDEEP

1536:vVqqMgLjJvyKjIXHWmmm/g3ueag8WSZT5xMJ1ZOv1Ic6:Aux0X/bg3Xag/SZNxMJ1ZOv1It

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	560	conhost.exe	30

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	920	WScript.exe
4	920	WScript.exe
7	920	WScript.exe
9	920	WScript.exe
10	920	WScript.exe
11	920	WScript.exe
12	920	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Claim_C736.wsf"
1⤵
- Blocklisted process makes network request
PID:920

C:\Windows\system32\conhost.exe
conhost.exe rundll32.exe C:\Users\Public\amLE5PKlGAXrhpU.dat,bind
1⤵
- Process spawned unexpected child process
PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads