Overview
overview
10Static
static
3inv.iso
windows10-2004-x64
3out.iso
windows10-2004-x64
1Unpaid_order-.lnk
windows10-2004-x64
3also/by.gif
windows10-2004-x64
1also/get.txt
windows10-2004-x64
1also/like.dll
windows10-2004-x64
10also/on.gif
windows10-2004-x64
1also/there.gif
windows10-2004-x64
1also/what.gif
windows10-2004-x64
1also/worker.cmd
windows10-2004-x64
1also/worker.js
windows10-2004-x64
1Analysis
- max time kernel
93s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
05/02/2024, 11:12
Static task
static1
Behavioral task
behavioral1
Sample
inv.iso
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
out.iso
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
Unpaid_order-.lnk
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
also/by.gif
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
also/get.txt
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
also/like.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
also/on.gif
Resource
win10v2004-20231215-en
Behavioral task
behavioral8
Sample
also/there.gif
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
also/what.gif
Resource
win10v2004-20231222-en
Behavioral task
behavioral10
Sample
also/worker.cmd
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
also/worker.js
Resource
win10v2004-20231215-en
General
- Target also/get.txt
- Size 242KB
- Sample240205-na8dzagdbq
- SHA256 b8aaf33cb48aa39a41700384f9dee291ceadfed830bed67dca7488f558a23957
- MD5 8de30ee3be338f27921eb8cfa5b95571
- SHA1 d1b58eb5aab93a49c0ced3701e2b1bbc540e63d1
- SHA512 a87177315c68a1b0947f3aa1db422fac6ed399838d7b5b91997bf6c8ae435fcf43500ac39642fa3da36a718891b4fc0a722e081b2c6d606d6fe20dacb1207e93
- SSDEEP 6144:3ebzXgBXKlDcWHamQlDFlDvUmVlDTBQdBbqPBzKbCOd2slDHOshCTlcZns:FzBQ8ogPxis
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3452 NOTEPAD.EXE