aa5b7b6ffd4b55a0dd00296a4112bbbc4e3fbc8ee6b9f11d2f1751b55d5a15bf | Triage

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-12-2022 05:29

Sharing

Report Analysis Logs

General

Target

PayInfo/ContractChanges.txt
Size

150B
MD5

3f717355be0e241ee4397f61e6ea3817
SHA1

22e969ba6bde2e62a51b0d1d07828c10e552d06c
SHA256

e795f727c00d73c22aa34cf531238730bc997c4ba9a5caa350f6bd98ff1f6822
SHA512

e9acaa11e87fcabca0fb822bdac85fd27a640b71323c5f72a6d0da7ca98bbef676244ec06a26ec8c5b689abeac2749c4e959ea3bb2670df1e710e4f7f820622b

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1456 NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\PayInfo\ContractChanges.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1456

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-54-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download