27b26e8e8a87518fe2ebb7c545283d4b35d9fb90d7f714307a5b4d2883848d10

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/07/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
slitz/Programs/Output/ProxyScraper/ProxyScraper.txt
Size 13B
Sample260708-kkpg3adv7z
SHA256 27b26e8e8a87518fe2ebb7c545283d4b35d9fb90d7f714307a5b4d2883848d10
MD5 31a66f8bfca0bf86046d559088293935
SHA1 b098409d8e7dccef8bbb7205ab4b03fb1ce262f7
SHA512 654a10ae764dbdd69982adc246010b85cc7c33bfe9fd4b3c60b8136eacc0921efe386e59c30dbead9f23f6e1eab204a6f3f09f0b1eb21a75b328e60b017d80a2
MD5 SHA1 SHA512

Score

3^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4972	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4972	2988	cmd.exe	81

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\slitz\Programs\Output\ProxyScraper\ProxyScraper.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\slitz\Programs\Output\ProxyScraper\ProxyScraper.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads