2c62189b7ec1fb37f913b02c325613edb8dedcfe45e5ef8dc69e17abbe9a9ae5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/07/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
slitz/requirements.txt
Size 152B
Sample260708-kkpg3adv7z
SHA256 2c62189b7ec1fb37f913b02c325613edb8dedcfe45e5ef8dc69e17abbe9a9ae5
MD5 eaa2bf8c7a7b0775f3007d390af847a6
SHA1 af2363c308605f9b6def27e9bebd23a9d0c44526
SHA512 d63474dc88c3c70142b47b92e077a295af272d8ba2b68be309aee0da8665439d1779b59b66e9abeac341809ca85124557cff0b0137038961be38631e156d0f7c
TLSH
T172C08C804A35A45472E1D6980D24821C9181E0015AA0237CAFAC188D040228C97A8218
MD5 SHA1 SHA512 TLSH

Score

3^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1124	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1124	1820	cmd.exe	82

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\slitz\requirements.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\slitz\requirements.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads