0657b9dc7b1654c32af18195fad0b95aee0dcb810994ffecc2f2daef6b3a37c7

Analysis

max time kernel
0s
max time network
91s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
24/12/2023, 15:29

Target

a.txt
Size

85B
MD5

e9bef20489bae9805f637c2f1449ee03
SHA1

349e923fb1bfb6da0c88bfd996f1000857875d01
SHA256

0657b9dc7b1654c32af18195fad0b95aee0dcb810994ffecc2f2daef6b3a37c7
SHA512

c267b5760b9566756439fb6ca29661f39334a43c2995eb719811cfdb00031bb8ffcd6e4720c96e3a7a2cf707423ce85a2457b7591dbb95b05215e61b07cef547

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
2704	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2704	4988	cmd.exe	22
PID 4988 wrote to memory of 2704	4988	cmd.exe	22

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a.txt
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2704

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact