4d6c9c29217933140e7f8bb5014dae7c689fcc788559a9c17fe9a8d9b7abe117 | Triage

Analysis

max time kernel
12s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-09-2022 19:37

Sharing

Report Analysis Logs

General

Target

all/weHave.js
Size

196B
MD5

7ba4d2a27ec678f4bbb990d5405191eb
SHA1

c8291a41346893684317135154c12f3fe69ef1f5
SHA256

897325b6f7b3ea4571b454befd3f2c3aac8bf60f86d961973c83905df0e2065c
SHA512

c8c0c3f3368eb90ad3fe41594895aa9e3a530caa3ae1451f812568b9c38434217a981f2a3d193bb69428b8e0c5fe65201cf9528dd5853f4d0ea6d78452ee5497

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\all\weHave.js
1⤵
PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-54-0x000007FEFC341000-0x000007FEFC343000-memory.dmp

Filesize
8KB

Download