799c6fe504001596a28fa37f5c5fac6e4612394a764f199c6b46fdd31724d6dd

Analysis

max time kernel
105s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
Size

1.4MB
MD5

5c254d25751269892b6f02d6c6384aef
SHA1

79106dd259ba5343202c2f669a0a61b10adfadff
SHA256

86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17
SHA512

ebde8f69487bf89570169fad50b494afb8859caf309bc6dde05979881100daebbcd38873277dc45f0108715f70418b3c9364909ec5a8bcb0ec2faac815a2f11e
SSDEEP

24576:lVN4zWHoN+fFqqPuD6Iedm2q3QKtgNIGqvKD9McwPDCkw6Bh0lhSMXlemqth5yR1:Fo5+fFqgdh02q3ntgNLqw9nwPDC7bODU

Score

10^/10

discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\Adobe\README.txt

Ransom Note

--= No news is a good news ! =-- Your network has been breached and all your files Personal data, financial reports and important documents has been stolen , encrypted and ready to publish to public, if you willing to continue your bussines and make more money and keep bussines secret safe you need to restore your files first, And to restore all your files you have to pay the ransom in Bitcoin. don't bother your self and wast your time or make it more harder on your bussines , we developed a locker that can't be decrypted using third part decrypters . making your self geek and trying to restore the files with third part decrypter this will leads to lose all your date ! and then the even you pay the ransom can't help you to restore your files even us. to chat with us : 1 - Download tor browser https://www.torproject.org/download/ 2 - go to one of these links above http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion 3 - you will be asked for your ticket id to enter the chat this for you : TICKET ID 77565753618715415149 usefull links : #OUR TOR BLOG : http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion

URLs

http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion

http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion

http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion

http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion

http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion

http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion

http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion

Signatures

Renames multiple (263) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\Web\\vhlocker.png"	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Web\vhlocker.png	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
File created	C:\Windows\Web\vhlocker.ico	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\.vanlocker\DefaultIcon	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vanlocker	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vanlocker\DefaultIcon	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vanlocker\DefaultIcon\ = "C:\\Windows\\Web\\vhlocker.ico"	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	528	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
Token: SeBackupPrivilege	2736	vssvc.exe
Token: SeRestorePrivilege	2736	vssvc.exe
Token: SeAuditPrivilege	2736	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4792	WMIC.exe
Token: SeSecurityPrivilege	4792	WMIC.exe
Token: SeTakeOwnershipPrivilege	4792	WMIC.exe
Token: SeLoadDriverPrivilege	4792	WMIC.exe
Token: SeSystemProfilePrivilege	4792	WMIC.exe
Token: SeSystemtimePrivilege	4792	WMIC.exe
Token: SeProfSingleProcessPrivilege	4792	WMIC.exe
Token: SeIncBasePriorityPrivilege	4792	WMIC.exe
Token: SeCreatePagefilePrivilege	4792	WMIC.exe
Token: SeBackupPrivilege	4792	WMIC.exe
Token: SeRestorePrivilege	4792	WMIC.exe
Token: SeShutdownPrivilege	4792	WMIC.exe
Token: SeDebugPrivilege	4792	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4792	WMIC.exe
Token: SeRemoteShutdownPrivilege	4792	WMIC.exe
Token: SeUndockPrivilege	4792	WMIC.exe
Token: SeManageVolumePrivilege	4792	WMIC.exe
Token: 33	4792	WMIC.exe
Token: 34	4792	WMIC.exe
Token: 35	4792	WMIC.exe
Token: 36	4792	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4792	WMIC.exe
Token: SeSecurityPrivilege	4792	WMIC.exe
Token: SeTakeOwnershipPrivilege	4792	WMIC.exe
Token: SeLoadDriverPrivilege	4792	WMIC.exe
Token: SeSystemProfilePrivilege	4792	WMIC.exe
Token: SeSystemtimePrivilege	4792	WMIC.exe
Token: SeProfSingleProcessPrivilege	4792	WMIC.exe
Token: SeIncBasePriorityPrivilege	4792	WMIC.exe
Token: SeCreatePagefilePrivilege	4792	WMIC.exe
Token: SeBackupPrivilege	4792	WMIC.exe
Token: SeRestorePrivilege	4792	WMIC.exe
Token: SeShutdownPrivilege	4792	WMIC.exe
Token: SeDebugPrivilege	4792	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4792	WMIC.exe
Token: SeRemoteShutdownPrivilege	4792	WMIC.exe
Token: SeUndockPrivilege	4792	WMIC.exe
Token: SeManageVolumePrivilege	4792	WMIC.exe
Token: 33	4792	WMIC.exe
Token: 34	4792	WMIC.exe
Token: 35	4792	WMIC.exe
Token: 36	4792	WMIC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 2900	528	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	90
PID 528 wrote to memory of 2900	528	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	90
PID 2900 wrote to memory of 4792	2900	cmd.exe	92
PID 2900 wrote to memory of 4792	2900	cmd.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
"C:\Users\Admin\AppData\Local\Temp\86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe"
1⤵
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D733FEE7-3394-450A-B737-1B4D1F617D4E}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D733FEE7-3394-450A-B737-1B4D1F617D4E}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5084

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\README.txt
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact