0a27ebf898554fd69d06b065519d39588578872a7fc478fdf673d944e1f10d93 | Triage

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 08:52

Sharing

Report Analysis Logs

General

Target

more/nowUp.js
Size

218B
MD5

83a12bb52e0808fe520d1d5df455e6f1
SHA1

58626291cc37efc9126d3b77f783572066158c16
SHA256

feee9f805af5006c8ae41af2ddbae1757d24bf5dcecc44be649a563cfc548b39
SHA512

b2aef47bd56dca1f5a34b42e1b429e2672ca033ec61eca9ca4f914a32abb7e9b31ec62bdbaae8a1f42fb20de5128d4193e68f4a0ebd721d1ca93471c18df1d72

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\more\nowUp.js
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-54-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download