8e834cf0e625b235d6a40931d224e7237728738db89b3272c6ebb504c9b90720

Resubmissions

09/05/2026, 18:22

260509-wzvs6sby513

09/05/2026, 17:40

260509-v86flabs5v3

09/05/2026, 17:14

260509-vsg33aaz6t1

Analysis

max time kernel
898s
max time network
407s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
testing.txt
Size 2KB
Sample260509-v86flabs5v
SHA256 8e834cf0e625b235d6a40931d224e7237728738db89b3272c6ebb504c9b90720
MD5 ecd224903c1e70553f1853f1fa3e9f25
SHA1 fdbff82a61cef0b3278dc2fd4c4ffafa605a333e
SHA512 4cfca93b31079a516bf249fa840d3d6031958db343cc9e9fa6cf3cd00b7d8d6f033618dd7fd8e306ddf4c1d375f53ca1438f0b772707f28340363d662e608669
TLSH
T1D041B74D7B55E478DF8902C42D4AF8386E691A2646C7D446AB78E70C06DCEE8251220B
MD5 SHA1 SHA512 TLSH

Score

3^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3148	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 3148	4724	cmd.exe	79

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\testing.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\testing.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads