558909412427b05911a02cddfe00fc5e9d30bc38e1ba636d04aa7efb63438ec8

Analysis

max time kernel
433s
max time network
1151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
23-11-2024 03:47

Target

Project Buu/READ.txt
Size

64B
MD5

b185b3b82df61c6c8393ab1c5f48452b
SHA1

7a38d650ee36c7ec1d327bfcfbe274399f18ae1f
SHA256

bef6670cac1a35f22749634e9a63fd31b4eb3435b6eb9611cb2ef80f4b798268
SHA512

af82134874be7df3a8e5e64d8d3f31ccdec09f097f234a96ef01632f6de49008b34bb7c10be80a748b40062e17b7777465803da837b6ccca1c85ee2d67fc5be8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings cmd.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2380 wrote to memory of 1332 2380 cmd.exe NOTEPAD.EXE
PID 2380 wrote to memory of 1332 2380 cmd.exe NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	cmd.exe

description	pid	process	target process
PID 2380 wrote to memory of 1332	2380	cmd.exe	NOTEPAD.EXE
PID 2380 wrote to memory of 1332	2380	cmd.exe	NOTEPAD.EXE

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Project Buu\READ.txt"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Project Buu\READ.txt
  2⤵
  PID:1332

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact