e513658df9b96c8a30dfa822752035830d1e77fe643dc6ca41650b3120f440d3

Analysis

max time kernel
129s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
11/06/2024, 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MAGIX.Vegas.20.0.411/Ключ ЧИТАТЬ ПЕРЕД УСТАНОВКОЙ!.txt
Size

972B
MD5

00a91a78d20ade89629119b259503df6
SHA1

a00e2d7e0f4e6c9b6f418abf29cb4d70ba7b1229
SHA256

7a137444eec98ebffd59daf8d6032f52c70b60cf0b72f00c0ba32bbe5f8141e5
SHA512

ff294d8a24c7edba170d02b8d4d384d93b15219898c8adefc74e53164b6d2509542f4799bb67de4baa6e941e1540f77d7133b5b7f247b40a71b49750d2d3f0a0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4844	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4844	5052	cmd.exe	77
PID 5052 wrote to memory of 4844	5052	cmd.exe	77

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\MAGIX.Vegas.20.0.411\Ключ ЧИТАТЬ ПЕРЕД УСТАНОВКОЙ!.txt"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\MAGIX.Vegas.20.0.411\Ключ ЧИТАТЬ ПЕРЕД УСТАНОВКОЙ!.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads