8bc4750ded2d159bac1f8fdbccb9bb1aef83bfb921ba878ab39fdc7f6c16af7a

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EsoBR/CHANGELOG_OTIMIZACOES.txt
Size 4KB
Sample260419-e2fnlahw41
SHA256 8bc4750ded2d159bac1f8fdbccb9bb1aef83bfb921ba878ab39fdc7f6c16af7a
MD5 691620008adecd90f8dcc7b58110049a
SHA1 acacbe644831b994e3ee90938c0abb7cf0fe6eb3
SHA512 d97880eaec9f04e1ed35f9ffeadb7de55c36c22267c31e89254e5af1990af07ac1d9feed4dddbd21f6e0baee49e25e132b19831000491e44e3903e627c0f29ef
SSDEEP 96:JcHkpiePhlmj6Skz0X3Ew0yPyIid5uPFVUw:JcNghI5k4X3E4/k5u8w
TLSH
T16591747A1CD706660927C3D16BCB81C3C6949156B104D2A6E5DF5A14A1CCBC8F1FDEAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2028	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2028	3264	cmd.exe	79

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\EsoBR\CHANGELOG_OTIMIZACOES.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\EsoBR\CHANGELOG_OTIMIZACOES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads