What’s the Attacker’s Real Goal? 🕵️‍♂️ Gathering Fragmented Clues and Having AI Summarize the ‘Attack Scenario’ and ‘Intent’

Jul 14, 2026

—

Hello, security analysts dreaming of becoming Sherlock Holmes! 🔎

We’ve come a long way so far.

Static Analysis: We found encryption tools and blackmail messages hidden in the code.
Dynamic Analysis: We executed it in a sandbox and caught it manipulating the registry.
MITRE ATT&CK: We even converted these behaviors into professional terms like T1486 and T1490.

Now, your desk is piled high with Technical Artifacts. But what management or clients are really curious about isn’t “So, what files were tampered with?”

“So, what does this hacker want? Money, information, or system destruction?”

It’s the ‘Attacker’s Intent’ and ‘Objective’. It’s the task of weaving hundreds of technical fragments into a single ‘Crime Scenario’. This requires a lot of insight if a human does it, but we have an AI Profiler.

Today, we’ll practice feeding all the analysis data we’ve collected to AI and asking it to “draw the big picture of this attack.” 🧠✨

1. 🧩 Preparing Input Data: Our Fragments

First, let’s organize the information to give to the AI. (These are the results from the previous practice session.)

[Static Analysis]
API: CryptEncrypt, CryptGenKey, WriteFile, DeleteFile
Strings: ALL YOUR FILES ARE ENCRYPTED, restore_guide.txt, .locked
[Dynamic Analysis]
Behavior: cmd.exe executes vssadmin.exe Delete Shadows (disabling recovery)
Persistence: Self-registration in HKCU…Run key
[MITRE ATT&CK]
T1486 (Data Encrypted for Impact)
T1490 (Inhibit System Recovery)

These are ‘Facts’. Now it’s time to ask the AI for ‘Insight’.

2. 🗣️ [Prompt] Turning AI into a ‘Cybercrime Profiler’

Don’t just ask for a summary; ask it to analyze the attacker’s psychology and strategy.

📝 Intent Analysis Specific Prompt

[Role] You are a cybercrime psychological analyst and a Threat Intelligence (TI) expert.

[Task] Based on the technical analysis data (Technical Findings) provided below, infer and summarize the attacker’s ‘Intent’, ‘Objective’, and ‘Attack Scenario (Narrative)’.

[Analysis Data]

1. Key APIs: CryptEncrypt, InternetOpen

2. Discovered Strings: “Your files are encrypted”, “bitcoin wallet address…”

3. Key Behaviors: Deletion of shadow copies (vssadmin), registration in startup programs

4. MITRE IDs: T1486, T1490, T1547

[Request] Explain in business terms, divided into the following 3 items:

1. Core Objective of the Attack: (e.g., financial extortion, industrial espionage, hacktivism, etc.)

2. Reconstruction of the Attack Scenario: Describe the flow from infiltration to objective achievement as a story.

3. Severity and Intent Analysis: Analyze what kind of psychological pressure the attacker tried to exert on the victim, whether recovery possibilities were left open, etc.

3. 📤 [Result] The Full Story of the Crime Written by AI

AI connects fragmented technical terms to create a perfect story.

🤖 AI Analysis Result (Example)

🕵️‍♂️ Attacker Intent and Scenario Analysis Report

1. Core Objective of the Attack: Financial Gain This attack is clearly a ransomware campaign aimed at financial extortion. It is optimized for holding data hostage and demanding a ransom (Bitcoin), rather than information leakage or system destruction.

2. Reconstruction of the Attack Scenario (The Kill Chain)

Persistence: As soon as the attacker executed the malware, they registered themselves in the registry (Run Key) to secure a ‘foothold’ so that the attack would persist even if the user rebooted the PC.

– Impact: Before the full-scale attack, shadow copies (backups) of Windows were quietly deleted using the vssadmin command. This blocked the ‘escape route’ for victims to recover on their own without paying.

– Action: Subsequently, user files were locked with a high-strength encryption algorithm using the CryptEncrypt API, and restore_guide.txt was left on the desktop to attempt negotiation.

3. Severity and Intent Analysis

– Intent: Given the use of ‘Inhibit System Recovery (T1490)’ techniques, the attacker has a deliberate intent to definitely extort money, not just a prank.

– Pressure Tactic: This employs a sophisticated psychological pressure tactic to increase the probability of payment by making the user feel despair when attempting recovery and finding no backups.

4. 💡 Why is this process important? (The “So What?”)

If you only do technical analysis (e.g., “T1486 detected”) and stop there, management will ask, “So what?”

However, understanding the intent as above changes the response strategy.

If for financial gain (ransomware)? ➡️ Immediately block the network, isolate backup servers, decide whether to negotiate with the hacker.
If for information theft (spyware)? ➡️ Identify leaked data, trace the leakage path through log analysis, prepare for legal action.
If for destruction (wiper)? ➡️ Prepare for system reconstruction, activate Business Continuity Plan (BCP).

In other words, the ‘intent’ summarized by AI becomes a compass that guides decision-makers to make the right judgments.

🎉 Conclusion: Ready to Write the Report!

Congratulations! 👏 You have now moved beyond the realm of a Technician and gained the perspective of a Threat Intelligence Analyst who sees through the essence of an incident.

We have now prepared all the ingredients.

Fact: Code, logs, MITRE ID
Insight: Attacker’s intent, scenario, objective

Now, only one thing remains! It’s time to plate these delicious ingredients beautifully. In the next, highly anticipated final lecture, “[Final] Automatically Generate Expert-Level Malware Analysis Reports (PDF format) with AI,” we will brilliantly conclude this entire process.

Until the day your analysis story is perfect! Good luck! 📝🚀