Overview
overview
10Static
static
3MayhemAim/....3.exe
windows10-2004-x64
10MayhemAim/README.txt
windows7-x64
1MayhemAim/README.txt
windows10-2004-x64
1MayhemAim/assets.js
windows7-x64
1MayhemAim/assets.js
windows10-2004-x64
1MayhemAim/...ns.txt
windows7-x64
1MayhemAim/...ns.txt
windows10-2004-x64
1MayhemAim/license.txt
windows7-x64
1MayhemAim/license.txt
windows10-2004-x64
1Analysis
-
max time kernel
91s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-04-2024 15:21
Static task
static1
Behavioral task
behavioral1
Sample
MayhemAim/MayAimV1.3.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
MayhemAim/README.txt
Resource
win7-20231129-en
Behavioral task
behavioral3
Sample
MayhemAim/README.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
MayhemAim/assets.js
Resource
win7-20240215-en
Behavioral task
behavioral5
Sample
MayhemAim/assets.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
MayhemAim/instructions.txt
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
MayhemAim/instructions.txt
Resource
win10v2004-20231215-en
Behavioral task
behavioral8
Sample
MayhemAim/license.txt
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
MayhemAim/license.txt
Resource
win10v2004-20240226-en
General
-
Target
MayhemAim/license.txt
-
Size
6KB
-
MD5
0b09566254b011d989decf0e23a902eb
-
SHA1
3ae5cd6be73daf418b8deee9c865cf78225838c9
-
SHA256
a19d58aaab15c4d0019e569d1c073d1b5286fdd37dbeee7a58a7d1ae76045ae1
-
SHA512
4e22e58f925879306261e5993039e1d84d87f8fecc0f9fdad534da55b6fd22be77e622a4077d8d521f7734e5535f66853d581155987e2f3607e2d386938c218b
-
SSDEEP
192:uEwjuKsgA4+XYdXjA+okS63vZBCSUziJm:eNs8+QRVxBRU1
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3860 NOTEPAD.EXE
Processes
Network
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request23.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.110.86.104.in-addr.arpaIN PTRResponse41.110.86.104.in-addr.arpaIN PTRa104-86-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request218.110.86.104.in-addr.arpaIN PTRResponse218.110.86.104.in-addr.arpaIN PTRa104-86-110-218deploystaticakamaitechnologiescom
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
23.159.190.20.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
41.110.86.104.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
218.110.86.104.in-addr.arpa