Overview

overview

10

Static

static

SK.vbs

windows7-x64

10

SK.vbs

windows10-2004-x64

10

cushioned/...rs.txt

windows7-x64

1

cushioned/...rs.txt

windows10-2004-x64

1

cushioned/slake.dll

windows7-x64

10

cushioned/slake.dll

windows10-2004-x64

10

cushioned/vista.jpg

windows7-x64

3

cushioned/vista.jpg

windows10-2004-x64

3

data.txt

windows7-x64

1

data.txt

windows10-2004-x64

1

Analysis

  • max time kernel
    28s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    16-11-2022 18:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cushioned/jodhpurs.txt

  • Size

    278KB

  • MD5

    67a9edf9219e665027b0dba649351996

  • SHA1

    b6fe3ffb41c22f5fd7ca4222b5f9e6f58ec727c3

  • SHA256

    ff925ea578bb4ce63ff47ca46ae644d84cd771b657a696c7f1cdff77245ae0ba

  • SHA512

    ef98a48bc7a449f570e82aa8ddc675c588425d5ee74b4f2b9b57bcabf63012bfa37e8864a52a4cf95b21a37492de009d211e10056e295dea67dd5b83fb974909

  • SSDEEP

    6144:jigwnDbwqP6wbTRwJtO4RoTb6wSwlBKcwtSnwCODHH5GTDpSDOaeH2rzOatHCta5:RwvwJwRwJtO6wSw5wqwCODHHHOaeH2vV

Score
1/10

Malware Config

Signatures

  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\cushioned\jodhpurs.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1232-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

    Filesize

    8KB

    Download