2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87

Analysis

user interaction
yes
max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 02:43

Target
Aurora.exe
Size 108KB
Sample260724-c7vctsfm21
SHA256 2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87
MD5 8ce68a756995deb55746dee1525edec3
SHA1 10b1d1fc1dc4f11bef3fea1163cf68a88c29d3cf
SHA512 f46adf3b92a43b82d0b6ea2652b42a284e25be45909e6c0529440625e7d2867460790778e80864702d56a301e2cb1202006977d8248330a33a4e2212dbbf46d5
SSDEEP 3072:rPdGIbRRYJTG8xqR8AaP3ZNKkz8rJYB1osiFAQgD5PxzU:znvuLxqR8Aahz91osEAQMlU
TLSH
T169B35B9AA39800D8CCA18174D5225217EBF1BC58176293DF0721F3590FBBAE67F3A749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1084	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5436	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Aurora.exe
"C:\Users\Admin\AppData\Local\Temp\Aurora.exe"
1⤵
PID:4188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4832