a69c2073ff31def83fd6e4035c86af9645c39f9b0a14d38029b1d337e2143610

Analysis

max time kernel
899s
max time network
552s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 12:19

Target
message.txt
Size 12KB
Sample260701-pha9wafz2s
SHA256 a69c2073ff31def83fd6e4035c86af9645c39f9b0a14d38029b1d337e2143610
MD5 c7422d087f0e7d70efd926f2525ecc62
SHA1 0c3a41d81010c80fad6bce415dbb9886bcb0a60b
SHA512 bee0017a578de280ece5c6a5a13651c1d66010e54f4156ba9017d548d705462298aff01479032b9a0b2b12057e31e15f4391c684f47aef6c58ad6ce1a231e8ec
SSDEEP 96:zIb9dz3odnw6SQkPhSwiMamqXJQAhtBr2K+OazJi+8rqYHkzIJa49CNXz9SMf/L3:49dz3xPMwisqXJQALpEos/3LiQ
TLSH
T1A942AFE2E75C813E61E79CC633FAEDF631E9171623917ED9C1A7058CF558106E2A022B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1044	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\message.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3808

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2828