e4606439b649d4635746c9a408e78492759398c12b952df2574ca871740002ad

Analysis

max time kernel
438s
max time network
1162s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10-09-2024 07:42

Target

PhoenixMiner_6.2c_Windows/Readme.txt
Size

51KB
MD5

859fcad14ab0ae20b2cd5f2bcbf45cec
SHA1

4e514159c6df8396ea1c19d095f3aa03e9c67f54
SHA256

7e017c23836e47cf0c5862f4e8762fc498f95a57a79cd506bf7b8bd92383612c
SHA512

c66f20a420ef793b9413d26509f4272de03d1d9b8ec3dbb0181642d2207b286d1b23318874d15ff8d7119b6c268c8757aefb558e85c5d74f21217b7b4bea4c97
SSDEEP

768:UXPsmLpqcEVk25XynkcVpeCIxpaso0MviA1yOjsPbPs/qQkDMf0hJMimg4VNrSMT:9kby7PxQPf0A7gucd465aIPe

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings cmd.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4820 NOTEPAD.EXE
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 3320 wrote to memory of 4820 3320 cmd.exe NOTEPAD.EXE
PID 3320 wrote to memory of 4820 3320 cmd.exe NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	cmd.exe

pid	process
4820	NOTEPAD.EXE

description	pid	process	target process
PID 3320 wrote to memory of 4820	3320	cmd.exe	NOTEPAD.EXE
PID 3320 wrote to memory of 4820	3320	cmd.exe	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\Readme.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:4820

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance