95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11

Analysis

user interaction
yes
max time kernel
220s
max time network
220s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe
Size 1016KB
Sample260507-fdqdkaez8v
SHA256 95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11
MD5 253f2fa3513a8e5bca9b33b0641f1539
SHA1 5f5373b5ee9ab3015f452ca70ae867ef4f866fd4
SHA512 8439d918956ca5b3ecb18175aef05b424973b1c37f0d55a2401c71ab5ccf21c324cea203f9ae45d91a11e6d8078c0b6039e35fd58bc6e28111b88c91ebeadfd0
SSDEEP 6144:zP2qrRSiqJT86ZWVAv/8CWNRO7lQDu2zkhzv:6lD4sGCqkL
TLSH
T1F2252056A7C4CEB2C05DC37068567A4C33F3EEE58ADA434F29A472BA2DF63C45D91A04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
884	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5100	powershell.exe
5100	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4792	WindowsTerminal.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4792	WindowsTerminal.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4792	2332	wt.exe	92
PID 4792 wrote to memory of 4412	4792	WindowsTerminal.exe	93
PID 4792 wrote to memory of 2136	4792	WindowsTerminal.exe	97
PID 4792 wrote to memory of 5100	4792	WindowsTerminal.exe	98
PID 5100 wrote to memory of 4532	5100	powershell.exe	99
PID 5100 wrote to memory of 1096	5100	powershell.exe	103
PID 5100 wrote to memory of 2676	5100	powershell.exe	106

C:\Users\Admin\AppData\Local\Temp\95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe
"C:\Users\Admin\AppData\Local\Temp\95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe"
1⤵
PID:4136

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe
"C:\Users\Admin\AppData\Local\Temp\95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe"
1⤵
PID:3504

C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -d "C:\Users\Admin\AppData\Local\Temp\."
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
  wt.exe -d "C:\Users\Admin\AppData\Local\Temp\."
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\wsl.exe
    C:\Windows\system32\wsl.exe --list
    3⤵
    PID:4412
- - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
    "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa08 --server 0xa04
    3⤵
    PID:2136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe
      "C:\Users\Admin\AppData\Local\Temp\95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe"
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe
      "C:\Users\Admin\AppData\Local\Temp\95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe" --help
      4⤵
      PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe
      "C:\Users\Admin\AppData\Local\Temp\95f5f2273a6c57958b39ced732d0ae9ea06cc8eba05806ec5637dc423baefc11.exe" -d
      4⤵
      PID:2676

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\WER.0f2a5d38-7fc4-498a-8b0c-7b2b05b567f0.tmp.WERDataCollectionStatus.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_fa5tr35p.wou.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fa5tr35p.wou.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/884-23-0x00000260F5AA0000-0x00000260F5B4E000-memory.dmp

Download

memory/2136-12-0x00000272C2C00000-0x00000272C2CAE000-memory.dmp

Download

memory/4792-11-0x000001FC98870000-0x000001FC9891E000-memory.dmp

Download

memory/5100-16-0x000001F073830000-0x000001F07384E000-memory.dmp

Download

memory/5100-54-0x000001F073A30000-0x000001F073AE3000-memory.dmp

Download

memory/5100-14-0x000001F05AD50000-0x000001F05AD62000-memory.dmp

Download

memory/5100-15-0x000001F0738B0000-0x000001F073926000-memory.dmp

Download

memory/5100-10-0x000001F0737E0000-0x000001F073826000-memory.dmp

Download

memory/5100-9-0x000001F0733A0000-0x000001F0733C2000-memory.dmp

Download

memory/5100-53-0x000001F073850000-0x000001F07386C000-memory.dmp

Download

memory/5100-13-0x000001F05ACA0000-0x000001F05ACAC000-memory.dmp

Download

memory/5100-55-0x000001F0737C0000-0x000001F0737CA000-memory.dmp

Download

memory/5100-56-0x000001F073890000-0x000001F0738AC000-memory.dmp

Download

memory/5100-57-0x000001F0737D0000-0x000001F0737DA000-memory.dmp

Download

memory/5100-58-0x000001F073AF0000-0x000001F073B0A000-memory.dmp

Download

memory/5100-59-0x000001F073870000-0x000001F073878000-memory.dmp

Download

memory/5100-60-0x000001F073880000-0x000001F073886000-memory.dmp

Download

memory/5100-61-0x000001F073F10000-0x000001F073F1A000-memory.dmp

Download