Overview

overview

10

Static

static

Agreement_ZXY61.iso

windows7-x64

3

Agreement_ZXY61.iso

windows10-2004-x64

3

Agreement.js

windows7-x64

10

Agreement.js

windows10-2004-x64

10

data.txt

windows7-x64

1

data.txt

windows10-2004-x64

1

debunked/helixes.txt

windows7-x64

1

debunked/helixes.txt

windows10-2004-x64

1

debunked/intrepid.txt

windows7-x64

1

debunked/intrepid.txt

windows10-2004-x64

1

debunked/p...ss.dll

windows7-x64

10

debunked/p...ss.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    47s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2022 15:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    debunked/helixes.txt

  • Size

    120KB

  • MD5

    f8fe7740c50118b6db8fa69ec591d002

  • SHA1

    907785605794191068543af9400935f4c95c2e1f

  • SHA256

    cbc5bd7cf00e1d65fa989e522178945f69d21ceb826c8e2ee373753c837d4f2a

  • SHA512

    0f6818dc2accec0cc98d863c8a7a757944d3dd7cbaa03d7b6a40bce6ce004f4fe28143af814f0e0f1e4598d1fdc9deaade4a0b0552d699f4e8e3d802663dabfe

  • SSDEEP

    1536:aqZSkGq/IZShxDZgU8Zfxvi8kZwRLQGfxFg:AkGkxEJdjA

Score
1/10

Malware Config

Signatures

  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\debunked\helixes.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/860-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

    Filesize

    8KB

    Download