b5ab6b1de38d69970bcbde570120826c35e78e609e926b3785c15de4baf91a36

Analysis

max time kernel
42s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 03:00

Target

ThunderAimV2.03.exe
Size

1.3MB
MD5

e008cab782522d69601a32ee34384979
SHA1

f568330250ccfb86e04f484ad1d7cf59a92e42a8
SHA256

b5ab6b1de38d69970bcbde570120826c35e78e609e926b3785c15de4baf91a36
SHA512

c5a6b1402630c1acc38fd819e82cd19c90e0da2fe6f204a514f3cbc68459308f9bec62167906a7e1e7f7f693a38170617fbaada4697152d92fce021c4041a076
SSDEEP

24576:AX23yuL46QkT3jvtRpq1Hc91L7LLxQXT/roTeGZOKLnP7EBtdzAR/L17RA8nonhL:eEuQNirETeGZvP7EBttY/L1dchaQcmYD

Score

1^/10

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4792	Notepad.exe

C:\Users\Admin\AppData\Local\Temp\ThunderAimV2.03.exe
"C:\Users\Admin\AppData\Local\Temp\ThunderAimV2.03.exe"
1⤵
PID:664

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\SplitUnprotect.vbs
1⤵
- Opens file in notepad (likely ransom note)
PID:4792