ac7886cc666943c2c5e44e3b87c60c7e0540454ba0b51c4bf2b7ea54c0fd083c

Resubmissions

17/07/2023, 14:12

27/06/2023, 10:40

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 14:12

Target

ac7886cc666943c2c5e44e3b87c60c7e0540454ba0b51c4bf2b7ea54c0fd083c.js
Size

763KB
MD5

9f008ed4394230c96e4d1ae70f01b637
SHA1

dd1108e83b22d21ba4b703472caaa162b1174928
SHA256

ac7886cc666943c2c5e44e3b87c60c7e0540454ba0b51c4bf2b7ea54c0fd083c
SHA512

b42d2a85209b8480d4a9d752d7622b5d2b4cbedfc5d8051a844583d1f1cbec3a763d556cd7626c446db84300a1b5ec041b105ffa52642d62a0d1de0e1e3eef6c
SSDEEP

12288:VVYBuZ0kC6mDEKZEA7S8m0N219zZH2LuLZEiUroOpqHCZFMHCcyZK5D2dBHEMBO4:VVYoukC6mDDZEA7SP9dWLuLZNOpqiZyk

Score

8^/10

Blocklisted process makes network request 4 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ac7886cc666943c2c5e44e3b87c60c7e0540454ba0b51c4bf2b7ea54c0fd083c.js
1⤵
- Blocklisted process makes network request
PID:2680

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact