dd9b18269b845bce0a3d6e3168c27c86f901e1f8c64510bdec0c3bf145e4e432

Analysis

user interaction
yes
max time kernel
10s
max time network
3s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 22:32

Target
configs.user.ini
Size 422B
Sample261022-2fy95sys7k
SHA256 dd9b18269b845bce0a3d6e3168c27c86f901e1f8c64510bdec0c3bf145e4e432
MD5 bc7a28b88ea08bf05c5f7b389b506cea
SHA1 80c20c751f7e2cdaca6e4ca36a9ae20558847ec9
SHA512 a2e40ec8b7e8b9c0a014df75ee0adbfa3c4c5aa74b0348d15226b1ad655dc7cc06df873287b584bd37a758afa856123f779c73c1d153fcdc09ff54c2dca35f27
TLSH
T1C1E0F126580B19B91F720AB274E57EFE4F0E92DC09402DDD33C123165192CC2D821F44
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
2384	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\configs.user.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:2384