53eafeee2c494c3418d47a25664a414619885cc92447a735657b2ceedad71cde | Triage

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 18:56

Sharing

Report Analysis Logs

General

Target

metaphysic/choked.txt
Size

221KB
MD5

c6a3f23a15df0367b84fb3233673e85c
SHA1

3e86493470835ba04db6ccadb77e37bae422fba5
SHA256

1db1054fbc2158fd8fc73cf92f03d9816d48fc92a5023164c52bea820f71199d
SHA512

e578dbfe8b7bf719897664f65d28b9fc0461bdab754e665202d48d6e0f3237fec80a908344b22326459f36880dbc0bd25c6b3124f6a7adc26880f2659479f99b
SSDEEP

3072:XoCkLSl+AMwmeG68MgWMNftCtMiv07iXQQk5:4FulJNxT8RWkf8bv07iw5

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4860 NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\metaphysic\choked.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads