Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
14/07/2024, 15:06
General
-
Target
FrostWare.WebView2.edt2/package/esm/vs/editor/contrib/folding/folding.css
-
Size
1KB
-
MD5
36bd38f90b3e4d47fa72e5def464d11e
-
SHA1
0a54f86f80ea14a19490f29b569a5ba8cc853bb6
-
SHA256
952887e7529d8b0f6f00ef99245b5d942498b38e6d722aa3e85ec41cc61a19ff
-
SHA512
4402db50f6bab004df8bf4c42b606dd34771b8971e02ba06fd0492392765880e20c49efd009291d94247b109077db6d43fb71a59fc51bc82c087c2cbbe59db26
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FrostWare.WebView2.edt2\package\esm\vs\editor\contrib\folding\folding.css1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\FrostWare.WebView2.edt2\package\esm\vs\editor\contrib\folding\folding.css2⤵
- Opens file in notepad (likely ransom note)
-