8980487cbbb41e228db10a11e1e583582b584bd41c1ba94762399621e3eeb391

Analysis

max time kernel
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 05:50

Target
MWTESTS/JustCause4.exe
Size 267.1MB
Sample260701-gjk7gahs21
SHA256 8980487cbbb41e228db10a11e1e583582b584bd41c1ba94762399621e3eeb391
MD5 6a23c578589a800be6f22b2e0c7e65e8
SHA1 c7b345f52bbfc48ba819c19186d36d8dc5571005
SHA512 2d252ee436b8b8b17aedbcded79de8fd512b6c7237b9317301007c16c03ba1427889a6011b4bf8f0d696acceed1e86d967840b3eca4f7c9f0c541ab96375c361
SSDEEP 6291456:f/CcZlzIgkckuqV14WilC4q94e4rTopnZzPu9cMy28GyP:f/CcZlzGci14WilC4q94DPopnZzPu9cB
TLSH
T187D8BEE6EAE2056FE42BD330C5A5622AD2A17720072582FFA152435BBD77FDE15BC700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
2840	notepad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 2840	6084	JustCause4.exe	89

C:\Users\Admin\AppData\Local\Temp\MWTESTS\JustCause4.exe
"C:\Users\Admin\AppData\Local\Temp\MWTESTS\JustCause4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe "C:\Users\Admin\AppData\Roaming\EMPRESS\_Supprort_and_Contact.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2840

_Supprort_and_Contact.txt

Path C:\Users\Admin\AppData\Roaming\EMPRESS\_Supprort_and_Contact.txt
Size 842B
SHA256 e3deebb58776da0d07da38ee61d258e4742255b6c997ab63b03d1c00feb83042
MD5 54bf97f1b9b36777b7402d9550c3bdd5
SHA1 031412735715523363107d028cebdf2ebb3cbca9
SHA512 14838869e841d5734307f50f289553126fd245c44dd2dd53dee5186ce2cf8aad8c0761817d613984a88c60002199636b49d1bd7538da4536476fd3fdbf97dd7e
TLSH
T19501F11E269B455823818365351EB013F6448088B1A6576B36BD68D033A4326D7D91DE
MD5 SHA1 SHA512 TLSH

Submit Download