cb1c5d37bf6f3bf5ffe8f44848938bd5c952388e882019156186dec7f4ae2ecd | Triage

Analysis

max time kernel
55s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2023 03:06

Sharing

Report Analysis Logs

General

Target

Set-up.exe
Size

54.6MB
MD5

628abec1290f132ece6a863002fb62be
SHA1

5d230f5a366de8b31842bdbb201ecdd805450854
SHA256

ad508f9803d731e76d1970b104b52f1d50324a2e556ec3f829f4c44344655ebd
SHA512

758683122112935c6f96e0c85dc41daa3a60d452a446da7169554d885224db184198aa80fe8c626e785ae2deb703b4f4cb8c0961f21e6c28ca7cef7026d6eaef
SSDEEP

49152:Fi9vxcikNtXHGalFwlph3uUapbpOQKpb5jJYVa15EI2dtGifV9FKc0i7h01t23:AypXutiOpENG4V9K23

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2904 NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
PID:536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\PopSubmit.bat" "
1⤵
PID:2524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\PopSubmit.bat" "
1⤵
PID:4248

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x390 0x4f8
1⤵
PID:2776

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\PopSubmit.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...