a2537a57e66931b1fa8879dbd5b2c47946f082d42cf1fb744384c0f4c65c7178 | Triage

Analysis

max time kernel
146s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
21-06-2023 21:48

Sharing

Report Analysis Logs

General

Target

README.txt
Size

1KB
MD5

e1be3906675a5a4f221589d37c0c51a6
SHA1

ef93321350fa6d6e96fe70d3386b19aa83591c1f
SHA256

a2537a57e66931b1fa8879dbd5b2c47946f082d42cf1fb744384c0f4c65c7178
SHA512

f18d8811532d488423d0c3c77aaebfc632ef16c8daf3ea26f8efd33fc6d0693c4c4ec5accfa6ba45e5fc1908cf95b3829c5e874f23512e2c40284161651337a3

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2168 NOTEPAD.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

NOTEPAD.EXE

pid process

2168 NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\README.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads