07c0803413b78a90b641c0035cd99e8aabe2d63456a06809941153564efec41b | Triage

Analysis

max time kernel
77s
max time network
17s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 12:32

Sharing

Report Analysis Logs

General

Target

Bytel.Commandes.RestApi.exe
Size

146KB
MD5

af9153375a0f7612e3e35d6b2f96b742
SHA1

512f1bd65ee6b5d1c49fd868fe1bedecd134a420
SHA256

75a4965cebac9b9c7917ca99f1e8559e0e8f04593a95724a0fadbe970a1667b9
SHA512

cf223540280daaa78f9f492113fea2ecbf6fe42528e1bc2445ccbb1a7368cfb5a753ff33a485fab0c81141b50a9e39d8283ae1a5e036f903f31158128dc6768d
SSDEEP

3072:Kczkitvo4BpYN/6mBPry8TXROLdW5m4mURh9OOGP0kk:KA4NCmBPry/N2VOOa

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 2 IoCs

pid	Process
1908	NOTEPAD.EXE
2500	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\Bytel.Commandes.RestApi.exe
"C:\Users\Admin\AppData\Local\Temp\Bytel.Commandes.RestApi.exe"
1⤵
PID:1188

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2660

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Bytel.Commandes.RestApi.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1908

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Bytel.Commandes.RestApi.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads