c1d16d4287bff47727b7b5fd82f784fe3767efa49cad3ba49efd792f04eb3228

Resubmissions

03-10-2024 19:56

241003-yn3qraxcnf 7

03-10-2024 19:55

241003-ynlggatdrm 3

Analysis

max time kernel
98s
max time network
114s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-10-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VanishRaider-main/stuff/emojis.txt
Size

328B
MD5

2deff49dacfcf756731956520b902555
SHA1

420e4a61ef3dbcb722327d83411f457f6bd6167b
SHA256

d4bb9e4f10d69314815a3b61df307ffd8d40ebf920b252f409bc4373c5d90a29
SHA512

b51a25be8d960466db813b76dacad689e6c27cf993a4d4b0d2e3ed2b0aa0081c4c29334583c09432a832d60f10ad619713c20f0c5d9c688bf82884c1d0a22dbc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 4652	1072	cmd.exe	79
PID 1072 wrote to memory of 4652	1072	cmd.exe	79

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VanishRaider-main\stuff\emojis.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\VanishRaider-main\stuff\emojis.txt
  2⤵
  PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads