Overview

overview

10

Static

static

3

system_processor.exe

windows7-x64

10

system_processor.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    system_processor.exe
  • Size 170KB
  • Sample250310-lnhpcszrs4
  • SHA256 dfab719b8ac43ff2f8a10aea5e04fd4eb273f6cdcea11c610aa68d1c3f6f989d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
credential_accessdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\case_id.txt

Ransom Note
  • Case ID: C0QAJK ## ⚠️ YOUR FILES HAVE BEEN ENCRYPTED ⚠️ Your important files have been **encrypted** by **[Ransomware Group Name]** using military-grade encryption. This includes all documents, photos, videos, databases, and other critical data. You cannot access them without our decryption key. ### What Happened? We have locked your files with a unique encryption algorithm. Decryption is **impossible** without the corresponding private key. ### How to Recover Your Files? To restore access, you must pay **[Amount] Monero (XMR)** to our secure wallet: 💰 **Payment Amount:** [XMR Amount] 📥 **Monero Wallet Address:** [Monero Address] ### After Payment: 1. Send proof of payment along with your **Case ID** to our email: **[Contact Email]** 2. Our system will verify the transaction. 3. We will provide the **decryption software** and **unique key** to unlock your files. ### IMPORTANT WARNINGS: ⏳ **You have [Countdown Timer] to pay** before the price **doubles**. 🚨 If you fail to pay within **[Final Deadline]**, your files will be **permanently lost**. ❌ Attempting manual recovery or using third-party tools **will corrupt your data**. 🚫 Do not contact authorities—they cannot help you, and failure to comply will result in total data loss. ### How to Pay? 1. Buy **Monero (XMR)** from a cryptocurrency exchange (Binance, Kraken, etc.). 2. Transfer the required amount to our wallet address. 3. Email proof of payment and your **Case ID**, and we will handle the rest. 🔒 **Your files are locked. The choice is yours. Act now before it's too late.**

Extracted

Path

  • C:\Users\Admin\case_id.txt

Ransom Note
  • Case ID: SPEIFS ## ⚠️ YOUR FILES HAVE BEEN ENCRYPTED ⚠️ Your important files have been **encrypted** by **[Ransomware Group Name]** using military-grade encryption. This includes all documents, photos, videos, databases, and other critical data. You cannot access them without our decryption key. ### What Happened? We have locked your files with a unique encryption algorithm. Decryption is **impossible** without the corresponding private key. ### How to Recover Your Files? To restore access, you must pay **[Amount] Monero (XMR)** to our secure wallet: 💰 **Payment Amount:** [XMR Amount] 📥 **Monero Wallet Address:** [Monero Address] ### After Payment: 1. Send proof of payment along with your **Case ID** to our email: **[Contact Email]** 2. Our system will verify the transaction. 3. We will provide the **decryption software** and **unique key** to unlock your files. ### IMPORTANT WARNINGS: ⏳ **You have [Countdown Timer] to pay** before the price **doubles**. 🚨 If you fail to pay within **[Final Deadline]**, your files will be **permanently lost**. ❌ Attempting manual recovery or using third-party tools **will corrupt your data**. 🚫 Do not contact authorities—they cannot help you, and failure to comply will result in total data loss. ### How to Pay? 1. Buy **Monero (XMR)** from a cryptocurrency exchange (Binance, Kraken, etc.). 2. Transfer the required amount to our wallet address. 3. Email proof of payment and your **Case ID**, and we will handle the rest. 🔒 **Your files are locked. The choice is yours. Act now before it's too late.**

Targets

    • Target
      system_processor.exe
    • Size 170KB
    • SHA256 dfab719b8ac43ff2f8a10aea5e04fd4eb273f6cdcea11c610aa68d1c3f6f989d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    credential_accessdiscoveryransomwarespywarestealer

    • Renames multiple (786) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks