b297a76de5182907a69a878cf161ca65b274152eb92a9d9591248ac4f5494dcf | Triage

Resubmissions

20-02-2023 05:44

230220-gflzlahc6w 10

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-02-2023 05:44

Sharing

Report Analysis Logs

General

Target

langs/English.ini
Size

107KB
MD5

525ce1c02ca53f9c63cb697ed3aae899
SHA1

9ddc2763d9dd663f3cb0febf0d580e21c52c2f18
SHA256

0f9d467f6bb6f682c0d1351b26038950c73720f2bfc0741ec1c7bfab2046d75f
SHA512

734d599d839b1266c42f340e044243ae30d1859d314eed7738f72f59201d19359f1ac6ee0cac8bfef4a0a2b8f2232a4f1f33336770c8c43f929c1bef162d2317
SSDEEP

1536:5S5Ybl8/lKlXiF3y24FMuRvV5I7BohUT1:xxXiVQV5uJ1

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2012 NOTEPAD.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

NOTEPAD.EXE

pid process

2012 NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\langs\English.ini
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:2012

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-54-0x000007FEFC361000-0x000007FEFC363000-memory.dmp

Filesize
8KB

Download