1c64d0c574dc0c8c3ab60566fce1f1b18ebf8a783b7201593b87c77dd22a0b7f

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2023 10:32

Target

933856 R1.jse
Size

905KB
MD5

7fd3a40a48aee5e994672a3cd7c4d8c2
SHA1

7b814f578350c15035e3b5ac60d6d71979b4ccfa
SHA256

84d767087d3b9316aa441b8f521b96a2834c139ac157117e8980cf013b2d3e5f
SHA512

f97cfac31153c839f3616fc90dddd8f140f28da8afc66d0aa24375787ffcc92dc6a0b8352da8faf7a120615ec13e440019d265232940d065d00ead250cc344dc
SSDEEP

12288:UvP4AJLJDrz/pLfYoV4WvP4AJLJYvP4AJLJuvP4AJLJYvP4AJLJ5VovP4AJLJYvM:4rz/pLaVc

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
61	2092	WScript.exe
67	2092	WScript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ons.jse	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact