Analysis
- user interaction
yes - max time kernel
294s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
paaayload.txt
Resource
win10v2004-20260911-en
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
paaayload.txt
Resource
win11ltsc2024-20260911-en
2 signatures
900 seconds
General
- Target paaayload.txt
- Size 2KB
- Sample261024-am2kasdh64
- SHA256 4a78ad5dcc61f65871061a1449aca6fb5a90e885ed9051a33a2e19b9a241a7a4
- MD5 db54fea9d3016781cd85ac9ff788c119
- SHA1 7ca37bc4a32e703fa111b93295d17848f38e28a3
- SHA512 0a7494920c7912a1ee4fbb210e5c4bc585e57dcc39c7e72db29613060779b8f1a73ed04e577ee3e8d3e84f856adbefd50ac3b86c2af573b4d2f2aa66f59ae5c5
- TLSH T110414769CA75F9E403BE71A099362E5730D51B63DBB55EB8C64204E60D14349CF2B3DC
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- Suspicious clipboard content. 1 IoCs
A suspicious script was copied to clipboard.
ioc Process powershell -e JABzAGUAdAB0AGkAbgBnAHMAIAA9ACAAJwB7ACIAVwBEACIAOgAgAHQAcgB1AGUALAAgACIAYQBkAG0AaQBuAHIAdQBuACIAOgAgAHQAcgB1AGUAfQAnACAAfAAgAEMAbwBuAHYAZQByAHQARgByAG8AbQAtAEoAcwBvAG4AOwAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAPQAgACIAegB5AEkAZQBCAG0ARwBYADIAVA NOTEPAD.EXE - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5164 NOTEPAD.EXE