f516ab25ca5ccedca8a8d95d7efa6e0984bdf41091a79097668462aee2d5bd9d

Analysis

max time kernel
438s
max time network
440s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12/08/2024, 13:02

Target

IM NEVER LEAVING!/ILL ALWAYS BE WITH YOU SOOS.txt
Size

8KB
MD5

560f4550bc61b25140140f6237085bb2
SHA1

7d67adf95176d2edbce9c467ccaca32623093b58
SHA256

0a9013c31b9aca53f4d2ae083d576a185dbd2e07b90b5aa9e6f83c13532a68b5
SHA512

f1ace2bccf3cfb082b64f6bcab19c2c73756dde7f4332f8f30cad75343414b95ee2a399da06f3df8ca3bba98eac8af4dc8a32aa2f5aaefcff93d42e0407191d9
SSDEEP

96:MemtRhYfRG5Qep+VMBlyeSVEgiwPNc+D+U4EfVYyStgNtxlwVD8:nmtRhYfRtVcoXHiWgUeKNPlwVY

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 2488	3764	cmd.exe	82
PID 3764 wrote to memory of 2488	3764	cmd.exe	82

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\IM NEVER LEAVING!\ILL ALWAYS BE WITH YOU SOOS.txt"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\IM NEVER LEAVING!\ILL ALWAYS BE WITH YOU SOOS.txt
  2⤵
  PID:2488

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact