e18b2f0c87fe57524099cfa20bf851c71272be52a3f133c063ace5f4f35b04f3

Analysis

max time kernel
1744s
max time network
1753s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
27/01/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Free_Proxy_List.txt
Size

79KB
MD5

9da41d796c3b9b38124b2b0b8e671824
SHA1

0083eb10da97bc09dae923fa4b29f1b871c2ab18
SHA256

e18b2f0c87fe57524099cfa20bf851c71272be52a3f133c063ace5f4f35b04f3
SHA512

aec3e100f0b219014cdedf86f4836c9126357179e3d5881125103cd446ab266a4beed12543de2f26f0651f0d63ef4812af3d300e2107fceabe6692564b003040
SSDEEP

768:g6JW0spu7so++kT0LGR9DZQ9U1mXXEsPx9MoYDHaeqfX5KVDXJnCj7iQdmzlS8xr:p2uwgX5NfXo3nC9hMWwOU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4888	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4888	2888	cmd.exe	77
PID 2888 wrote to memory of 4888	2888	cmd.exe	77

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Free_Proxy_List.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Free_Proxy_List.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads