Analysis
- max time kernel
900s - max time network
583s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 04:15
Static task
static1
Behavioral task
behavioral1
Sample
cookies.txt
Resource
win10v2004-20260513-en
34 signatures
900 seconds
Behavioral task
behavioral2
Sample
cookies.txt
Resource
win11ltsc2024-20260710-en
2 signatures
900 seconds
General
- Target cookies.txt
- Size 4KB
- Sample260715-evpb6aes31
- SHA256 331057d48668e381c776c47ee74c77d64c0ced3fa3d899dbab3d51f805693107
- MD5 503035e2da6f9b94543195adade061cb
- SHA1 1a31fb885335e4211b207af724f58cd2930980e0
- SHA512 85fc19b5d737bf777299bc5a0b5b9f2376f1985906e4a32937502f4b8a1d58a93e1992d8143ff50a72b6327f18f001a1cf795be286c42e3e32d64a2cd12c45ea
- SSDEEP 96:cpYZAGLLl1NANYZAGLLlZTB7TYZAGLLlU1YZAGLLlKMEMYZAGLLlI:JZz9ZzR4ZzxZz0Zzy
- TLSH T164A1641811241CBE9E87126A7D092ECDAC3C0A535548DEF9FCA9CD5CC5A1B6242F98CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Opens file in notepad (likely ransom note) 1 IoCs
pid Process 6072 NOTEPAD.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6072 NOTEPAD.EXE
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\cookies.txt1⤵
- Opens file in notepad (likely ransom note)
- Suspicious behavior: GetForegroundWindowSpam
PID:6072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3732
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:4680