3217c9caadb949d74cc2040bcca570cd1bd33f7d6d7c33ee1c9aa85c89139aff | Triage

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 08:52

Sharing

Report Analysis Logs

General

Target

him/fromIts.js
Size

139B
MD5

529ef44381ae86ddd1cfa47049c66a25
SHA1

aa37742066d39650cdbc8d1fff7e32c5093dd04d
SHA256

8ccaa1f6b974e1c7aa05f1bab12bac902653e07309a0944031024b420091597f
SHA512

6b9d03a895436c5b6577d12be632a5048f4f8e24c55407ba264f99e6efca32f41ac8ce2145ae33b5d9eec1458a193f86446bf5a0a774df4180341851dec6324d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\him\fromIts.js
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-54-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

Filesize
8KB

Download