d991aa2b1fad608b567be28e2d13d3d4f48eea3dea8f5d51a8e42aa9a2637426 | Triage

Resubmissions

29-10-2021 11:55

211029-n3khlshhgq 10

29-10-2021 11:51

211029-n1a66ahhgn 10

28-10-2021 17:34

211028-v5e48sggcm 7

Analysis

max time kernel
600s
max time network
602s
platform
windows7_x64
resource
win7-en-20210920
submitted
29-10-2021 11:55

Sharing

Report Analysis Logs

General

Target

d991aa2b1fad608b567be28e2d13d3d4f48eea3dea8f5d51a8e42aa9a2637426.bin.sample.exe
Size

192KB
MD5

20ab243fee91b6c8df23e1ddefff2727
SHA1

e2b098d36e51d2b7405fadbd578cf9774433f85a
SHA256

d991aa2b1fad608b567be28e2d13d3d4f48eea3dea8f5d51a8e42aa9a2637426
SHA512

153955fb3418797676a49d3d563affc8b5a987a5e5740de29ae2b24ba178c39ee95346b98b7ec79bf6c370cf0067eb206abc68465aadd5cd7cf31ab55071fde0

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1864 NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\d991aa2b1fad608b567be28e2d13d3d4f48eea3dea8f5d51a8e42aa9a2637426.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\d991aa2b1fad608b567be28e2d13d3d4f48eea3dea8f5d51a8e42aa9a2637426.bin.sample.exe"
1⤵
PID:816

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SyncClear.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-54-0x000007FEFC351000-0x000007FEFC353000-memory.dmp

Filesize
8KB

Download