ff87d820baf913ae59727dab8579b9f2d349b95bfb78aebcfeeb91cbce8c6ce3 | Triage

Resubmissions

27-02-2023 04:37

230227-e83rpsbf3s 8

27-02-2023 04:25

230227-e2b1eabe9v 3

27-02-2023 04:20

230227-ex6n8abg69 8

27-02-2023 04:14

230227-ets9qabe8t 4

12-02-2023 12:22

230212-pkc69adh37 8

Analysis

max time kernel
43s
max time network
55s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27-02-2023 04:20

Sharing

Report Analysis Logs

General

Target

license.txt
Size

19KB
MD5

90df4d454db203057f5860b62f8771e3
SHA1

dc038d536a218fbecb83c6ad28990e9b8e655699
SHA256

8bd137ca8047a040d6d7e96b68910bc3b78b9b223c13420113f92c0e0fd39452
SHA512

f498a5987530cf8595c34450df616bfb890a566e4faa4f4bbe6669ef49c8bc0864533ab376661ebfc8857c7b86851d9c489388e60f9da48bce5dd39a0db19223
SSDEEP

384:Thj2PmwERb6k/iAVX/dUY2ZpEGMOZ77o0UDqHnfBVRbVXSIavl6J:Th6un1iYWrTXo0UDqHmy

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

400 NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\license.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...