Analysis

  • max time kernel
    91s
  • max time network
    203s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07/05/2024, 03:43

General

  • Target

    Other/Source/LauncherLicense.txt

  • Size

    17KB

  • MD5

    ffa10f40b98be2c2bc9608f56827ed23

  • SHA1

    dc8f2e570bf431427dbc3bab9d4d551b53a60208

  • SHA256

    189b1af95d661151e054cea10c91b3d754e4de4d3fecfb074c1fb29476f7167b

  • SHA512

    1420da3215ed30afcf413935e20404cabe0723822c728ea29dcb9699533355ef1bee17660facdb55655241c2db30a7314d8ad6a4a3f72576b2721f522d487aa9

  • SSDEEP

    384:H4j2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPpDqHZ:H46uh1iYWrTXoPpDqHZ

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Other\Source\LauncherLicense.txt
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3736
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Other\Source\LauncherLicense.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:2076

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads