fe04cf710700a364c38f52835fa222dc9dfd01002f1f1fdaf64cd758ce8f8c6b | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2022 18:37

Sharing

Report Analysis Logs

General

Target

swore/personalize.txt
Size

260KB
MD5

d874ce67de2b1fa668011615d933de6d
SHA1

5347670534a0ec81801eebd98fc326c9c3f30c22
SHA256

de4db839a630a5d2c4bc3cffc92db37fee1b3ef03d0ad201daaf8a8573a41e9e
SHA512

38ab254a4c9f271f521937ab83c98805dd189004d6a9472be5010434f80f81a211336b23ff5830b1c378f611727609b2bd6d13b3727664d7219de6e2fccaf7c9
SSDEEP

3072:VMUkGEsLSvmaM3lzkTMYXQQkBTM3sJqM1rMY2ukQk0l2:VaGEoSvma0lgTxwBT0kqnYMXv

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4956 NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\swore\personalize.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...