Resubmissions
29/07/2024, 17:10
240729-vpz5gazeqp 129/07/2024, 17:09
240729-vpcdeathqh 114/06/2024, 04:49
240614-ff6tbszbpj 129/03/2024, 06:22
240329-g4ycjabe4t 129/03/2024, 06:17
240329-g16vhabd8v 105/02/2024, 17:04
240205-vlb88seefk 125/01/2024, 15:42
240125-s5e35ahhf6 325/01/2024, 15:41
240125-s4smtsaghm 1023/12/2023, 03:09
231223-dnx52sgfa6 1022/12/2023, 01:18
231222-bn5h1sbfel 10Analysis
-
max time kernel
134s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
29/03/2024, 06:17
General
-
Target
Universocraft_by__JuPo_2022.yml1.txt
-
Size
41.8MB
-
MD5
2fada81ace28689122dc2da8858012f8
-
SHA1
56141bf7cff07a2365de8c35f6cbff920fc8419d
-
SHA256
5bceebc1d2b6899ca9b532e00eda646aec85221ac82d77392476f4cfc1d714cd
-
SHA512
45fe19b69cbfbda326849c91733e25d9c989e4927530142df79be00394e75059a1987530ec9237dd421c092e606da3816da3066fdd9b0a53dfccef88e19c8437
-
SSDEEP
49152:nSMCSyZLZMLF3fesg0TNIAtpzxjz4oJi1h10f7KANvl4oJgGi1h4c+oZhCCD5cXI:d712B5C+IVz08gO10eWZiuz
Score
1/10
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Universocraft_by__JuPo_2022.yml1.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵