Overview

overview

1

Static

static

autorun.inf.zip

windows7-x64

1

autorun.inf.zip

windows10-2004-x64

1

autorun.inf

windows7-x64

1

autorun.inf

windows10-2004-x64

1

Resubmissions

01/02/2023, 14:53

230201-r9lk2aca9t 1

01/02/2023, 14:21

230201-rpf5tabh7x 1

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2023, 14:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    autorun.inf

  • Size

    92KB

  • MD5

    2c29248d7b2ee96a8f3d516dae36c310

  • SHA1

    0e73e5f50253e821fd87bb845aea0983ccfae404

  • SHA256

    7611738317dabe43daeeb0b45698c0e37ecfd546d29761a63e57dd779984589b

  • SHA512

    1229db37d8366ea9f4c8636e874113f2f07cff5eb2b495c4ade8d1c5004d47b9374cabe20acb02919271580cb9b9458c90621c0123554e2683b40ef6fdedcde9

  • SSDEEP

    1536:uvE5/VJ8m0HJnppEnANcFqAsVH8cObGyHSTG0ugUfOgsZ3Z4:ksh6pl/H8nbGyHST+gUfOfC

Score
1/10

Malware Config

Signatures

  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\autorun.inf
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:4196
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4684

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads