2a1517114997b3bf7578867e4d212566305c2387a47ba1e534ca8a71ad814c53 | Triage™

Analysis

user interaction
yes
max time kernel
899s
max time network
458s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YUMI/license.txt
Size 10B
Sample260913-ldly2axvbx
SHA256 2a1517114997b3bf7578867e4d212566305c2387a47ba1e534ca8a71ad814c53
MD5 2e48f4ef4f6a0e3159b5e50a3c7c9557
SHA1 9c032dced5a29102e4d660be7dd221a8e221317a
SHA512 443389e05ae9c394c49aa8df1f3c1dfa6b7ec2f0fb7483b2b3d2a90200a5d8b1a976830a2edf5d85e8566dc3a766df8c152e5038380a6c4aab7bbc48e77b50ef
MD5 SHA1 SHA512

Score

1^/10

ransomware

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4320	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\YUMI\license.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4672

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads