Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-09-2024 18:22
General
-
Target
Jules/Monaco/package/esm/vs/editor/contrib/snippet/snippetSession.css
-
Size
561B
-
MD5
3e3fdc1d0685be3b068d2b09da05298a
-
SHA1
407b0524850492eefd9041884305812863da9a62
-
SHA256
c9939da092af0e32aae7f264bb2b00b03f572fc1f880fe18ff6e6105a34316aa
-
SHA512
55a0da7949539539bf1c409288f51c802da1088bcd5bb13ead693ffdddecafac5bf8b48c39255e7a73dca1da124e09e8d699c950ddae28266bf6e3c2c4d692f7
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Jules\Monaco\package\esm\vs\editor\contrib\snippet\snippetSession.css1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Jules\Monaco\package\esm\vs\editor\contrib\snippet\snippetSession.css2⤵
- Opens file in notepad (likely ransom note)
-