e4606439b649d4635746c9a408e78492759398c12b952df2574ca871740002ad

Analysis

max time kernel
436s
max time network
1159s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10-09-2024 07:42

Target

PhoenixMiner_6.2c_Windows/config.txt
Size

812B
MD5

7be2dbfa0ea8411903f9da88b6f32317
SHA1

380db1367c6a740687368621718704a4b86107b9
SHA256

bd55ec593a96825cc0f86f9d9263b1a0cdb642f07651099d4adae72107ff8833
SHA512

10c6389cbec0877e2b6d1a4f46bbfed18f1338c223810784614c03dbd8819116c518deca0b6f6064c707e1eed5b319ba0c2c6fb817c06023433658579f3428bc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings cmd.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2032 NOTEPAD.EXE
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2452 wrote to memory of 2032 2452 cmd.exe NOTEPAD.EXE
PID 2452 wrote to memory of 2032 2452 cmd.exe NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	cmd.exe

pid	process
2032	NOTEPAD.EXE

description	pid	process	target process
PID 2452 wrote to memory of 2032	2452	cmd.exe	NOTEPAD.EXE
PID 2452 wrote to memory of 2032	2452	cmd.exe	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\config.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:2032

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact