dd87d8bee32291a4cc0632d651a24bdfee5a2da7e97f7b923b9aed89c91d3994

Resubmissions

22/07/2026, 19:08

260722-xs88nasfnh7

22/07/2026, 14:09

260722-rf7amswepc7

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
friend_request.exe
Size 290KB
Sample260722-rf7amswepc
SHA256 dd87d8bee32291a4cc0632d651a24bdfee5a2da7e97f7b923b9aed89c91d3994
MD5 74487d586a290592985b8f0add8b5959
SHA1 3fec957c95d4e184655c4717c95b03c8f0131ecc
SHA512 0014e6ee21c4daa6d6ab7b574031af4bd0433ca98e858246a1e50a16f5d2c484f3040af5184c912d77255298e6cb3e93232d4df6c5eec8504af6d390dc35db62
SSDEEP 3072:y1BvPkgE5Yims0TmXyi1zksprTBBQAhSXdnBXmVXcIFZuchiJ:y1B3FmXyi14sVTBwmVXceiJ
TLSH
T132542B9BFBC09D5BC61403718CFB4359373AF2E52B479B172A28B2342D53BE0AD86549
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	friend_request.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
912	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 912	6020	friend_request.exe	90

C:\Users\Admin\AppData\Local\Temp\friend_request.exe
"C:\Users\Admin\AppData\Local\Temp\friend_request.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\READ_ME.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

READ_ME.txt

Path C:\Users\Admin\AppData\Local\Temp\READ_ME.txt
Size 1KB
SHA256 5ba99818abafc41ef082a86a49d44f5e89f519dacd43b73273529ccfc8dbceff
MD5 764a8c3fb28243d0de2739d34d4125b3
SHA1 e4cfec38663f171e7188add1a5b7cca80cd36744
SHA512 4bf3184cff1e6a5fac0917c028d29c84c71354d1b5b213a4171ddc080f91f506be56ed6826df4d940a610630a2bc53ba1661baa2fd013cb2b627741e701fe76a
TLSH
T14D3143E224428040483732FB7C47F32FBE944A4ECD4A15F47B4D49AEC71B3CA48955CA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6020-5-0x0000000000400000-0x0000000000449000-memory.dmp

Download