5ce41c02b91fd082db2e4142305e6e31f435631a8571e16ba82b802b2a7a5209

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-01-2025 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ReadME.txt
Size

50B
MD5

09a20a82891e104daaddec37fce147c6
SHA1

110ba2519b3a8d7513c1f06731124a59e83b475e
SHA256

0fd51e1b797801219b288f1d340b01ba9d1b1bff73485a0e9626b03fe7bd72a7
SHA512

f90ed71e1639102eb33229880cbb98b380900cc09aa759007535f806b9dab968a2a2e777c22d0e43c7b20a55ff00245f3f1d990389c1f408cea6ab99f7fdb866

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
552	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 552	572	cmd.exe	78
PID 572 wrote to memory of 552	572	cmd.exe	78

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ReadME.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ReadME.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads