e544c99986ba3917404c7a2871e9840f13c5b60af7772f53b41de0be00ec8227 | Triage

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-09-2022 15:31

Sharing

Report Analysis Logs

General

Target

about/wellThing.js
Size

208B
MD5

5f60c99c6a73734338667bf85b2b2b51
SHA1

b9f42f5957d21acd3dbb25d3e5fe56e939e77ca7
SHA256

f53db0cabdb1d9610afcd83f825b126a0f82175bcafbdbd422aeeb15d7f58aa3
SHA512

15c5d182c4687a3e2a34f86dbeebcdf4793ba0bb9894f2a87d02c5a4211f27417f5c5e8cd9ca0e40b640faf5061c15eeb582ef14296941e3c31098aeaeab04cd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\about\wellThing.js
1⤵
PID:1972

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download