c0d3dfc1e72066434b51f0d18d4b94adb6d7dbc03dfd4dc4955b1ed3487700ee | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
15-09-2022 12:50

Sharing

Report Analysis Logs

General

Target

him/thenThat.js
Size

135B
MD5

b933f9c3135207256cb6a84c1934601f
SHA1

f372b32eb91483356f0a717d02e22cf421e514b0
SHA256

a5b3ed84b6b575da7fa2b59bf3906ca5e03b4e55cff64f1d0330d6873b8a63f6
SHA512

742c665da9ace55bcb6fb24f00b060412186dcefb4bcf0aab2cfab5b02d74bf838866e2a0550c576d7cdc38f291ad9fdda9f6b15b7a39e7f1f0aca962474232b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\him\thenThat.js
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download