Analysis
-
max time kernel
119s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
-
submitted
18/03/2024, 19:41 UTC
General
-
Target
Logs/adaptive_policy.log
-
Size
7.9MB
-
MD5
0a1184eb4dc548855efa0254ab5c3100
-
SHA1
0e12832c2e2c3f401135eec9b0e6f7a77c1be1aa
-
SHA256
4f10ecedea88baba7205970791810defe7c2efad228c996e0602891183636655
-
SHA512
841923f577a0e0ee2ecc5e9bc5f20888f395817e79f644ecfd5936d580f6862e24746b1f6fb131c657f267960e20556320f8a421877933c21b76df687abb187d
-
SSDEEP
24576:uGwLGvrxSrU2HpH8EJWff5xNJ355OCOCOCOCOvZlnuKWZi2QD2pYGIqdp52CTYwn:b
Score
1/10
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Logs\adaptive_policy.log1⤵
- Opens file in notepad (likely ransom note)
Network
-
DNS48.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse -
DNS234.17.178.52.in-addr.arpaRemote address:8.8.8.8:53Request234.17.178.52.in-addr.arpaIN PTRResponse
-
DNS36.56.20.217.in-addr.arpaRemote address:8.8.8.8:53Request36.56.20.217.in-addr.arpaIN PTRResponse
-
DNS36.56.20.217.in-addr.arpaRemote address:8.8.8.8:53Request36.56.20.217.in-addr.arpaIN PTR
-
DNS36.56.20.217.in-addr.arpaRemote address:8.8.8.8:53Request36.56.20.217.in-addr.arpaIN PTR
No results found
-
8.8.8.8:5348.229.111.52.in-addr.arpadns
DNS Request
48.229.111.52.in-addr.arpa
-
8.8.8.8:53234.17.178.52.in-addr.arpadns
DNS Request
234.17.178.52.in-addr.arpa
-
8.8.8.8:5336.56.20.217.in-addr.arpadns
DNS Request
36.56.20.217.in-addr.arpa
DNS Request
36.56.20.217.in-addr.arpa
DNS Request
36.56.20.217.in-addr.arpa