ef81ac0d15b52e782d94a291b6b6541c64d5d09dad0be86cee462d8608527767

Analysis

max time kernel
1470s
max time network
1485s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
26-07-2024 13:16

Target

Executor/Scripts/INFO.txt
Size

56B
MD5

25c6b9a9edad8363d48ecf95396e4c51
SHA1

5cc1ca69e0925f9947138e895ba6ef8ed789f2e0
SHA256

ed40a6a566c27f9808c02cf5e8f71013e247b14a4bfd5ddacd417b44ca577ac5
SHA512

41e1da80115a977058c839c4cd0eb32ba4febe125c10ba80c5f484aa8bd02eae6d7705516c6eceff7e0f9b26c0b56f8b3839a0e6119c5b0cb88db97c9009b066

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000_Classes\Local Settings cmd.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2892 NOTEPAD.EXE
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2020 wrote to memory of 2892 2020 cmd.exe NOTEPAD.EXE
PID 2020 wrote to memory of 2892 2020 cmd.exe NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000_Classes\Local Settings	cmd.exe

pid	process
2892	NOTEPAD.EXE

description	pid	process	target process
PID 2020 wrote to memory of 2892	2020	cmd.exe	NOTEPAD.EXE
PID 2020 wrote to memory of 2892	2020	cmd.exe	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Executor\Scripts\INFO.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:2892

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact