331d4789464156674383cdd37a130a9e6edc66ed1396a2be587ac64a193f6215 | Triage

Analysis

max time kernel
162s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 17:29

Sharing

Report Analysis Logs

General

Target

debunked/helixes.txt
Size

120KB
MD5

f8fe7740c50118b6db8fa69ec591d002
SHA1

907785605794191068543af9400935f4c95c2e1f
SHA256

cbc5bd7cf00e1d65fa989e522178945f69d21ceb826c8e2ee373753c837d4f2a
SHA512

0f6818dc2accec0cc98d863c8a7a757944d3dd7cbaa03d7b6a40bce6ce004f4fe28143af814f0e0f1e4598d1fdc9deaade4a0b0552d699f4e8e3d802663dabfe
SSDEEP

1536:aqZSkGq/IZShxDZgU8Zfxvi8kZwRLQGfxFg:AkGkxEJdjA

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

636 NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\debunked\helixes.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads