Resubmissions
09/05/2023, 17:51 UTC
230509-wfk5mafb5t 809/05/2023, 17:46 UTC
230509-wb98ysfb3x 708/05/2023, 22:53 UTC
230508-2vgcwaeh8s 7Analysis
-
max time kernel
306s -
max time network
317s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
09/05/2023, 17:51 UTC
General
-
Target
changelog.txt
-
Size
14KB
-
MD5
ab1301006a7bd5af1d8130ce4d526dc2
-
SHA1
342216089bcba24dac93872ea1f562ab57448af4
-
SHA256
eace59dead399fda4da8f560e5ee4d16dc2f62cea03857d2e8a59d9ce66dc57d
-
SHA512
6bc1f99cdc9c60e272e1cace376276bd3d4fefc90f9146106af158469d37c7f0c93ff0422dcc270b93f060b7735fe0860a7f3a056476e1b7ecf8a08e0407349c
-
SSDEEP
384:9ZlB/1lPqBvGGRSJPrkWSYdRmRJfcg1Eq1Gov0qixeUqJveZTKaCimh9GnT+B7UZ:9ZlB/1lPqBvGGRSJzkWSYdRmRJfcsEq8
Score
1/10
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\changelog.txt1⤵
- Opens file in notepad (likely ransom note)
Network
-
DNS86.8.109.52.in-addr.arpaRemote address:8.8.8.8:53Request86.8.109.52.in-addr.arpaIN PTRResponse -
DNS10.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request10.173.189.20.in-addr.arpaIN PTRResponse
-
DNS8.3.197.209.in-addr.arpaRemote address:8.8.8.8:53Request8.3.197.209.in-addr.arpaIN PTRResponse8.3.197.209.in-addr.arpaIN PTRvip0x008map2sslhwcdnnet
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
51.105.71.136:443
-
8.8.8.8:5386.8.109.52.in-addr.arpadns
DNS Request
86.8.109.52.in-addr.arpa
-
8.8.8.8:5310.173.189.20.in-addr.arpadns
DNS Request
10.173.189.20.in-addr.arpa
-
8.8.8.8:538.3.197.209.in-addr.arpadns
DNS Request
8.3.197.209.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa