3f2e89b07e7730999d80b41a44dc29f53aaba7875da5734b8158bfa74f645f3f

Analysis

max time kernel
92s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19-11-2024 20:30

Target

public/steambootstrapper_indonesian.txt
Size

4KB
MD5

1514d082b672b372cdfb8dd85c3437f1
SHA1

336a01192edb76ae6501d6974b3b6f0c05ea223a
SHA256

3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4
SHA512

4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55
SSDEEP

96:avbCWRRc1yRZY+lDz+Xo2drTRw2IoMTb9ISQISXOo8V8El:o+2S1yrYWsEo0uWq38V8El

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings cmd.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4780 NOTEPAD.EXE
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 3168 wrote to memory of 4780 3168 cmd.exe NOTEPAD.EXE
PID 3168 wrote to memory of 4780 3168 cmd.exe NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	cmd.exe

pid	process
4780	NOTEPAD.EXE

description	pid	process	target process
PID 3168 wrote to memory of 4780	3168	cmd.exe	NOTEPAD.EXE
PID 3168 wrote to memory of 4780	3168	cmd.exe	NOTEPAD.EXE

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_indonesian.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_indonesian.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4780

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact