Resubmissions
21/10/2023, 12:44
231021-pyrxkagb771021/10/2023, 12:08
231021-pbd27aga691021/10/2023, 11:58
231021-n5h3kaga481008/10/2023, 18:41
231008-xb6ffafb9s10Analysis
- max time kernel
150s - max time network
201s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
08/10/2023, 18:41
General
- Target Mathway20Database20Leaked20January202020.txt
- Size 545.2MB
- Sample231008-xb6ffafb9s
- SHA256 963edcc0ef0f02a227e40c4d1f7eb319ae32559baa290b24264aee027053ff62
Score
1/10
Malware Config
Signatures
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Mathway20Database20Leaked20January202020.txt1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2064-0-0x000001BF6B640000-0x000001BF6B650000-memory.dmp
memory/2064-16-0x000001BF6B740000-0x000001BF6B750000-memory.dmp
memory/2064-32-0x000001BF73A80000-0x000001BF73A81000-memory.dmp
memory/2064-34-0x000001BF73AB0000-0x000001BF73AB1000-memory.dmp
memory/2064-35-0x000001BF73AB0000-0x000001BF73AB1000-memory.dmp
memory/2064-36-0x000001BF73BC0000-0x000001BF73BC1000-memory.dmp