Resubmissions
21-10-2023 12:44
231021-pyrxkagb77 1021-10-2023 12:08
231021-pbd27aga69 1021-10-2023 11:58
231021-n5h3kaga48 1008-10-2023 18:41
231008-xb6ffafb9s 10Analysis
-
max time kernel
150s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
08-10-2023 18:41
General
-
Target
Mathway20Database20Leaked20January202020.txt
-
Size
545.2MB
-
MD5
21da4ab437bc44fe51239d0d74bd1910
-
SHA1
72406887174c2631fbdeaa638e58c4725957ce65
-
SHA256
963edcc0ef0f02a227e40c4d1f7eb319ae32559baa290b24264aee027053ff62
-
SHA512
61fbd111860700f84cd43fe2a52c21f2ffde763f504bf06c73fcaafe3fa968996c6439e5074bb14a01f75e770d1dde61e24b9939dff278414c913e4c888af327
-
SSDEEP
786432:n8mrDuYVNa3Z8+Q6c3iBmGzFUQN4fmm1S39Z2dfmMY65rUPxgRH:8ip
Score
1/10
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Mathway20Database20Leaked20January202020.txt1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB