1fa46c0210edb585455e915bcee056d98042b03f1e2d26c9b4fc590f1278611b

Analysis

max time kernel
145s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
01-02-2024 18:05

Target

Portfolio/assets/dropdown/css/style.css
Size

7KB
MD5

55bf276f73ef7c88f98c8a79e9a42488
SHA1

95644d658c5a473118c08894b9c469491a3a51fc
SHA256

180d8ca6812f97d5ef73a4fbc28c018bc1c3d9af25a174af4452b997b513a7f5
SHA512

f08cff2d231eaa821bb6667fb20c568f1ce06ed9f5ac4878a690fa51482ad034dbd0df2c17efc6898cc890c3d545d006fc2368cd15a5be049d3a94f691fd33f6
SSDEEP

192:4unJepSzgKLsguryPeGhVqyHzNrGyqni+/3AfYK/:q0Ff/1

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1199853020-417986905-91977573-1000_Classes\Local Settings cmd.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2852 NOTEPAD.EXE
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2428 wrote to memory of 2852 2428 cmd.exe NOTEPAD.EXE
PID 2428 wrote to memory of 2852 2428 cmd.exe NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1199853020-417986905-91977573-1000_Classes\Local Settings	cmd.exe

pid	process
2852	NOTEPAD.EXE

description	pid	process	target process
PID 2428 wrote to memory of 2852	2428	cmd.exe	NOTEPAD.EXE
PID 2428 wrote to memory of 2852	2428	cmd.exe	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Portfolio\assets\dropdown\css\style.css
2⤵
- Opens file in notepad (likely ransom note)
PID:2852

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance