4831c05c4abcbfd5f04b42049174191446fb1364df0476ee6f48ef52a3ce604d

Analysis

max time kernel
71s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2024 23:44

Target

NotRansomWare.exe
Size

35.9MB
MD5

d46672a4b89f7441e0fa1f2021f1df2e
SHA1

3fdb64839b9bf779790bf3540170fa2aefa98be3
SHA256

4831c05c4abcbfd5f04b42049174191446fb1364df0476ee6f48ef52a3ce604d
SHA512

cc96a5f62c8577fd3492764cb9b63ecd47391c5987fe3ebec7de106ba657a19acc973c6d93a0c24eb541eba04413a0e558465ced5007d150170901affde858d5
SSDEEP

393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfH:fMguj8Q4Vfv3qFTrYw

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4592	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 4720	1176	NotRansomWare.exe	86
PID 1176 wrote to memory of 4720	1176	NotRansomWare.exe	86
PID 4720 wrote to memory of 3180	4720	cmd.exe	87
PID 4720 wrote to memory of 3180	4720	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\NotRansomWare.exe
"C:\Users\Admin\AppData\Local\Temp\NotRansomWare.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "notepad C:\Users\Admin/Desktop/rnote.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\notepad.exe
    notepad C:\Users\Admin/Desktop/rnote.txt
    3⤵
    PID:3180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1116

C:\Users\Admin\Desktop\rnote.txt

Filesize
21B

MD5
52cdb01b6b961c7604cc7098bf131461

SHA1
f1aa48209b0fd13a1ef31d4d775a9d65ce9a33c3

SHA256
8f9d6f4f8579c389d36258286ca30275f74d063eb9c20d1971541ec8a17b9783

SHA512
c2c11c7de7bc2ce75fbb3fc011272c511b55c59477f8f09bae59c8caf79a1000b28519606cc13db76b20ae233eba2a1222461123c5cd71d9fece6149fbc2d494

Download Submit