Analysis

  • max time kernel
    118s
  • max time network
    132s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-06-2024 02:18

General

  • Target

    Tango Release/instructions.txt

  • Size

    302B

  • MD5

    b91989cc1085782007877cacd4a1dd42

  • SHA1

    9e6e7edd14410a6c0159250cc8150baaa579d923

  • SHA256

    f37680ea78e81fe9ba0403671c8080e3209161fb8918af09cc5bc46606569b48

  • SHA512

    6eb13a3d88474f5e2a44b95e9e1f88233dc11d500533e56cc3d13914339669ace9c347ca0a2421d551188dc868b6e646b52668c32b50e4dca404c12287d0a7ae

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Tango Release\instructions.txt"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Tango Release\instructions.txt
      2⤵
        PID:2824

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads