Overview

overview

10

Static

static

Agreement_ZXY61.iso

windows7-x64

3

Agreement_ZXY61.iso

windows10-2004-x64

3

Agreement.js

windows7-x64

10

Agreement.js

windows10-2004-x64

10

data.txt

windows7-x64

1

data.txt

windows10-2004-x64

1

debunked/helixes.txt

windows7-x64

1

debunked/helixes.txt

windows10-2004-x64

1

debunked/intrepid.txt

windows7-x64

1

debunked/intrepid.txt

windows10-2004-x64

1

debunked/p...ss.dll

windows7-x64

10

debunked/p...ss.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    41s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2022 15:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    debunked/intrepid.txt

  • Size

    92KB

  • MD5

    dcbdab48c170abf8db49869f38c45081

  • SHA1

    53f466efd20e4ffa75a180b78f49629541c69942

  • SHA256

    ec4e433ff0df119741cfbc4a80535ebbadc0429e86982ab1f662aa327856ffa2

  • SHA512

    86b0a8cf687740e54ad53d387e60e071e575c3fa8a5c9a59330332a51caf596a33ef447785d3af9fbd78a807466f42ce1732f2afb62b098ee78930440b5e22a1

  • SSDEEP

    1536:QGQcW1ZOVIcevj/tQlc1ZOVWHo/rzcROcbcXW1ZOVab0OW1ZOVX:QzV1ZOCj/tQO1ZOcHQCcm1ZO20f1ZOd

Score
1/10

Malware Config

Signatures

  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\debunked\intrepid.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1044-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmp

    Filesize

    8KB

    Download