df83a0141850ba352899bd7eaaac601d2e28fe742c4585f41bcd7d6f6fbd89b2 | Triage

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/09/2022, 03:02

Sharing

Report Analysis Logs

General

Target

unbelt/cherishingYawn.js
Size

181B
MD5

c056db077d12e65e36c8b99630e9db4d
SHA1

e06e2be65dffe35102ae6e66b98ea67217e7d788
SHA256

976654e210eeb04c4554ccb66ad604c10f92d369b7155cbd8f4b1b0ec3d2278f
SHA512

2972c8b15c313f8c431d65e16d501266d83e094c9b78e4cac5a6e69e11cc79bc11a7cffe2eed540e6ef7d4175a6787693c653af4faf09be1dfc9977396647b1c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\unbelt\cherishingYawn.js
1⤵
PID:288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Filesize
8KB

Download