53eafeee2c494c3418d47a25664a414619885cc92447a735657b2ceedad71cde

Analysis

max time kernel
136s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 18:56

Target

metaphysic/preyed.txt
Size

85KB
MD5

7741772d4a072119b308a292db71fba3
SHA1

d93d3aa15fbc1031a6c6cf267243cfeb55e43ef3
SHA256

59220a25e69e43f4af5aa414c5754b1991c2057ce54a8f6642488e3ab7e45738
SHA512

6235ada0fbf49f004956dcd7e976b78db2beef51b3944b9fd2958d6d7731a6d0c98b7b91586a5b43196e755952596683f4c88eccda7509d0c6445030fd5ffa92
SSDEEP

1536:xATNwiDtQlNHHoA1Zc/uo64E5clp1ZOVqqXwp17wiHj/t/cW1ZOViL:GwCtQzHHL1ZDaE5cv1ZOPwLwWj/t/V1X

Score

1^/10

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

3064 NOTEPAD.EXE

pid	process
3064	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\metaphysic\preyed.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3064