1c403fd488b70bde681b91a427ccf258d74bc1bd94c4633ed46beb38d60a0691 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 08:52

Sharing

Report Analysis Logs

General

Target

their/thingUp.js
Size

167B
MD5

4f6fb9f58861418cb21f8ffaa9916b0a
SHA1

0acd34b85edb572465411cab1b4219e02a3f1ae8
SHA256

fd6c4c273f07ba94fd0e98c3a9c790db8d93757fbc7dcbdb2ac3685a7f2a8e22
SHA512

e4d15b5a2a4b429e0a676e0cfe727ebc2eee6e80f5b03094a00efe60fa12354a70b968a7264ae7278028fe112ebf186645b7a30afc4f78d932e3139e8cb192f4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\their\thingUp.js
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download