6799b84fa6b93569ed74170f1d3f4718e8fd44cfd07e2523ceb983b2fa846b12

Analysis

max time kernel
90s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
10/05/2024, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ss.txt
Size

188B
MD5

5b371ba76e125d82304c354ba4dbbc02
SHA1

113c0985dcd1b12877626517d7a20606275899a3
SHA256

6799b84fa6b93569ed74170f1d3f4718e8fd44cfd07e2523ceb983b2fa846b12
SHA512

d420bb77b161166ab88a0e94e0c22d7a9acb3e23de13f843c2169055bbc1c29a44ae267c75d9b7872f28fd5325b0bce2e2de672d2f8e209100ce8221337bb552

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4544	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 4544	2600	cmd.exe	81
PID 2600 wrote to memory of 4544	2600	cmd.exe	81

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ss.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ss.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads