Overview
overview
10Static
static
6669f3ac-5...f8.zip
windows7-x64
16669f3ac-5...f8.zip
windows10-2004-x64
1Agreement_BMX87.iso
windows7-x64
3Agreement_BMX87.iso
windows10-2004-x64
3Agreement.js
windows7-x64
10Agreement.js
windows10-2004-x64
10data.txt
windows7-x64
1data.txt
windows10-2004-x64
1debunked/helixes.txt
windows7-x64
1debunked/helixes.txt
windows10-2004-x64
1debunked/intrepid.txt
windows7-x64
1debunked/intrepid.txt
windows10-2004-x64
1debunked/sorer.dll
windows7-x64
10debunked/sorer.dll
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 17:29
Static task
static1
Behavioral task
behavioral1
Sample
6669f3ac-5555-4635-a362-da152cb3cdf8.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6669f3ac-5555-4635-a362-da152cb3cdf8.zip
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Agreement_BMX87.iso
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
Agreement_BMX87.iso
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
Agreement.js
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
Agreement.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
data.txt
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
data.txt
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
debunked/helixes.txt
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
debunked/helixes.txt
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
debunked/intrepid.txt
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
debunked/intrepid.txt
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
debunked/sorer.dll
Resource
win7-20220812-en
General
-
Target
data.txt
-
Size
5B
-
MD5
bb692cc1e32054c2aa0ec80111dee5ef
-
SHA1
223bae19990c7398a55a7963ef239ca54c30f5ca
-
SHA256
5bbeb671347ca2e15fb64d618eb618d53d16f3d13507d1013cc0640afe212282
-
SHA512
acdb2796ff1ce68f1d3cc71a3058825c6a7c1d12ce1e0ef3341bfb3cb3e57cf2bd50b06160cc68b87e6349990606f146711a7907f2f4353c37f91afd923c11a6
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 520 NOTEPAD.EXE