5bceebc1d2b6899ca9b532e00eda646aec85221ac82d77392476f4cfc1d714cd

max time kernel
968s
max time network
973s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2023 23:23

Sharing

Target

Universocraft_by__JuPo_2022.yml1.txt
Size

41.8MB
MD5

2fada81ace28689122dc2da8858012f8
SHA1

56141bf7cff07a2365de8c35f6cbff920fc8419d
SHA256

5bceebc1d2b6899ca9b532e00eda646aec85221ac82d77392476f4cfc1d714cd
SHA512

45fe19b69cbfbda326849c91733e25d9c989e4927530142df79be00394e75059a1987530ec9237dd421c092e606da3816da3066fdd9b0a53dfccef88e19c8437
SSDEEP

49152:nSMCSyZLZMLF3fesg0TNIAtpzxjz4oJi1h10f7KANvl4oJgGi1h4c+oZhCCD5cXI:d712B5C+IVz08gO10eWZiuz

Score

5^/10

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7EF4C4B2-D617-41AC-B0EB-C8A289063696}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{120D7ABB-C21B-455A-8DF6-6881E8B66D59}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6825FC2B-98FA-49DE-B8C0-DA2300841854}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0788C862-85A6-47EA-9122-77847A71030B}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{AAEDAB72-08BB-498A-AA56-1333BD79AC1F}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0129D226-7E62-49F1-806D-C5F9E5B8C6B9}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{703E12A1-1230-4D2A-A6FF-E2975A2B55D6}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{96DFDD85-1C0F-4AF9-B297-CF3EEE4F0C90}.catalogItem	svchost.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
3068	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Universocraft_by__JuPo_2022.yml1.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:2076