3abf95ab3254933b78291d3ef8abcbc122cecb5856646d26cae0b22a6c39cb63

Analysis

max time kernel
300s
max time network
291s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 16:14

Target

YouContractChanges/YouContract.txt
Size

136KB
MD5

33da3079fc428064643180c2de737d14
SHA1

41d83593966a48cd9158ac9af1dd33634b80effb
SHA256

1acacd181536f64838fae0f4c39fc24c0a13cb275c5a3e5a3b4aea2ea44efd25
SHA512

dd324ccb14386a18ddb6959cf42619377c36be6bbb95364a8da56f8ab7d8a9922b45fbb0dd31f4a001aab3cbe3e5700ab145aad3bad3c051885828e80814b048
SSDEEP

768:kIcIAMcIIGuIyAIhIyQIHI/IgICI0IUIgIkIWxIgIqHIV2dOIsIVAIqYI10BIWX0:E

Score

1^/10

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4316 NOTEPAD.EXE

pid	process
4316	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\YouContractChanges\YouContract.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4316