Analysis
-
max time kernel
156s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
04/05/2023, 11:50 UTC
General
-
Target
nsm_vpro.ini
-
Size
46B
-
MD5
3be27483fdcdbf9ebae93234785235e3
-
SHA1
360b61fe19cdc1afb2b34d8c25d8b88a4c843a82
-
SHA256
4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b
-
SHA512
edbe8cf1cbc5fed80fedf963ade44e08052b19c064e8bca66fa0fe1b332141fbe175b8b727f8f56978d1584baaf27d331947c0b3593aaff5632756199dc470e5
Score
1/10
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\nsm_vpro.ini1⤵
- Opens file in notepad (likely ransom note)
Network
-
DNS154.239.44.20.in-addr.arpaRemote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse -
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
DNS63.13.109.52.in-addr.arpaRemote address:8.8.8.8:53Request63.13.109.52.in-addr.arpaIN PTRResponse
-
93.184.220.29:80
-
93.184.220.29:80
-
52.152.110.14:443
-
8.238.178.254:80 -
8.238.178.254:80
-
173.223.113.164:443
-
52.152.110.14:443
-
8.238.178.254:80
-
104.85.1.163:80
-
204.79.197.203:80
-
52.152.110.14:443
-
52.152.110.14:443
-
52.152.110.14:443
-
52.152.110.14:443
-
52.152.110.14:443
-
8.8.8.8:53154.239.44.20.in-addr.arpadns
DNS Request
154.239.44.20.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:5363.13.109.52.in-addr.arpadns
DNS Request
63.13.109.52.in-addr.arpa