c0d3dfc1e72066434b51f0d18d4b94adb6d7dbc03dfd4dc4955b1ed3487700ee | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
15-09-2022 12:50

Sharing

Report Analysis Logs

General

Target

him/thenThat.js
Size

135B
MD5

b933f9c3135207256cb6a84c1934601f
SHA1

f372b32eb91483356f0a717d02e22cf421e514b0
SHA256

a5b3ed84b6b575da7fa2b59bf3906ca5e03b4e55cff64f1d0330d6873b8a63f6
SHA512

742c665da9ace55bcb6fb24f00b060412186dcefb4bcf0aab2cfab5b02d74bf838866e2a0550c576d7cdc38f291ad9fdda9f6b15b7a39e7f1f0aca962474232b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\him\thenThat.js
1⤵
PID:1696

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download