Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

7

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

9

Ransomware...KB.exe

windows10-ltsc_2021-x64

9

Ransomware...KB.ps1

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.msi

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Resubmissions

30/11/2025, 12:12

251130-pc6htsvpft10

30/11/2025, 12:00

251130-n6lvvahl7110

09/11/2025, 19:58

251109-ypxk5asqhm10

06/11/2025, 21:43

251106-1kxrfatrhp10

03/11/2025, 21:39

251103-1hxzesak9z10

04/10/2025, 20:19

251004-y355es1qy910

09/04/2025, 13:37

250409-qwzeas1rx9

31/03/2025, 05:19

250331-fz687stwdz

31/03/2025, 05:18

250331-fzse2swn13

31/03/2025, 05:18

250331-fzmvkawnz8

Analysis

  • max time kernel
    359s
  • max time network
    370s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    31/03/2025, 00:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RansomwareSamples/Sekhmet_30_03_2020_364KB.msi
  • Size 364KB
  • Sample250331-apdw1ssjs8
  • SHA256 b2945f293ee3f68a97cc493774ff1e8818f104fb92ef9dbeead05a32fc7006ff
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
egregorlockysekhmetcredential_accessdiscoverypersistenceprivilege_escalationransomwarestealer

Malware Config

Extracted

Path

  • F:\$RECYCLE.BIN\RECOVER-FILES.txt

  • sekhmet

Ransom Note
  • -------------- | Attention! | -------------- Your company network has been hacked and breached. We downloaded confidential and private data. In case of not contacting us in 3 business days this data will be published on a special website available for public view. Also we had executed a special software that turned files, databases and other important data in your network into an encrypted state using RSA-2048 and ChaCha algorithms. A special key is required to decrypt and restore these files. Only we have this key and only we can give it to you with a reliable decryption software. --------------------------------------- | How to contact us and be safe again | --------------------------------------- The only method to restore your files and be safe from data leakage is to purchase a private key which is unique for you and securely stored on our servers. After the payment we provide you with decryption software that will decrypt all your files, also we remove the downloaded data from your network and never post any information about you. There are 2 ways to directly contact us: 1) Using hidden TOR network: a) Download a special TOR browser: https://www.torproject.org/ b) Install the TOR browser c) Open our website in the TOR browser: http://o3n4bhhtybbtwqqs.onion/13C67978CF0A518 d) Follow the instructions on this page. 2) If you have any problems connecting or using TOR network a) Open our website: https://sekhmet.top/13C67978CF0A518 b) Follow the instructions on this page On this web site, you will get instructions on how to make a free decryption test and how to pay. Also it has a live chat with our operators and support team. ----------------------- |Questions and answers| ----------------------- We understand you may have questions, so we provide here answers to the frequently asked questions. ==== Q: What about decryption guarantees? A: You have a FREE opportunity to test a service by instantly decrypting for free 3 files from every system in your network. If you have any problems our friendly support team is always here to assist you in a live chat. ==== ==== Q: How can we be sure that after the payment data is removed and not published or used in any nefarious ways? A: We can assure you, downloaded data will be securely removed using DoD 5220.22-M wiping standart. We are not interested in keeping this data as we do not gain any profit from it. This data is used only to leverage you to make a payment and nothing more. On the market the data itself are relatively useless and cheap. Also we perfectly understand that using or publishing this data after the payment will compromise our reliable business operations and we are not interested in it. ==== ==== Q: How did you get into the network? A: Detailed report on how we did it and how to fix your vulnerabilities can be provided by request after the payment. ==== -------------------------------------------------------------------------------------- This is techinal information we need to identify you correctly and give decryption key to you, do not redact! ---SEKHMET--- 3CSug/ypgXkTyNv4p2bu+rL3TPf0+r6fp+oFkVIcWHxVVU6ZJF60kE3fxaTfNWRyYmkbtLdixJgHwwbTINadPUPxUW8EPGBVulcC91g3FhigJ6PxWBeoqEemSdHMXB7jn565NTKiUIlp1OwhFHz+muFg4m5XzUNxvV3/+B09PA3voiR0oGBKkiL6s00OoZRTFOu4WcTRHwmoGK7nPfoBrjJc57BVI9r6qZkYtkYbiT3ASapAe53+JIkpwXJORjW717AQkH+I70p4ELHsHfW5pMi2qg3npSD4UBAqZ3TbiisoxVAI+OCULVgayXkf5BzOvABfrTT6y3GV8m+KaVpg4xixouXAW5nXlvpWfcEGP4J+aoaLDh02dOHQGsOm++hOlVtP5rpH1OnqNasNKobNUEvYX+WkbEuLJELKfo99vDOMgwsTzzXQxCKiIvoYrLl7wgRJcsLHG+eajmFYCwxxxrbfjM7KKjbqwZd7O2gbI+74y3wxnxm4KnYOQiOEb163FHkUdoG4CUM1QPq9RRFa2GNYgo1l69X4Mocz3F1+6Kn4V85uNpBiX6+l0fz3wSbT3Yv6rQEzi7PHwl/FMACy5pSgY/0VtIRcDl29xlGzyyYaGsTG1oR53HhfYtVYra2PKiWhTgJk/JCOFwESz69wMiwqcuO+e3A1feFWyE35JArytq3DZCwuahC62v9/R+mLvTffTEQ5jtKsb6bYaQxctCJDhpgdTxwVQRw4iUgQ45oAbdmY4mQs1qirOGJP+NMkZxO0/HGLmcxHZ/7Ry3YSiaYEtaJ5VXnbZwL2t5lEndMWirPM4LloLJuFKxGeNzi45HrdnjkUS+39spv97bh3mpZlkK98yGGbBx7Kia5/JeGytHvoLYcvAOEETfJhbVUoCURGvOIwMvzvbXzW2CtgBg5uBn2e7OBRIBmxlX9394kxMwTtC+TYnN4Yy4Zsto6+/1pGWPLW8nNftHLjn+Bqeltktowa/ThvsequOA4NjyOc2lcKRogaezORPggvP3zqBQ1DwG3VAI0d02MmjyheZJMhoIIdtAY+TNNmlwGB1WDbQPy8eMVygb/vHNbhG/eW7VfXjOV5uFBPEarSzBD9WZUQOlGvE0ealvGfg+NkoDXWqktjoSRONAHaForM9zzbT7wn6hq2vx21I5kP5eWGnWxknTPPs8PQ+I0ZwAct0uXPg04YyBZSiX/gUNemQjCq4VvH9Uynr0TAN7b6TnyC9AqqXo51IeGPgSHukLl7rupQwVSDHcc32OhidhFt7F6YAlcT9hThouSYpDooojMczxCzaTXTaqmEMyV9QDXirag8LTveMmoItfsUOLC27adERvbRd2kXqIah1xYroVxuatEFwbTER6kwSPergsCW1bF5Mxd8knU8bawF51YoSP3OuuCPvtbQtUPniM6DFfEHO3TK/qLXkfcvRM1JTac9kVNTzvxmHsDGDQ3rC0tJ8p7kC/hRa8RSfag5lYKG+MpyfgLC5vN7hdehxDMEBeEaYDNCBs0ma4oH5quQ7srvsrKFjy/Q7U1MqKj9q8lycrEa+9DxGLgJunAqAeC6HzlRSlhkH02RlWP+wQUANE2Cc/U+a3QlvzYL8ORe6kS/ZbaYeA2Vy0sctuVRYtrDkyXTO+flekQBifzNSlAjHuBMBO0QwYDkl9rxHP3HwdxOEoAWSJX7zwX2qftrHhXCfPwfkqVLogLQJWNHMeJcSkz9QSxGhSNNiL7Ljanx4gLFzna7eErA4yYHIM7NItzGDyP7EKwbfhomWXESqJLhu3TqB/Vo9gjk/Neoc8XUZLfP2ad6byuBd7WtuFWmyQj7vKddV0QCALWbEgk6wPGVqfeiWWnN47S7WwJvNSPm5t0RbCo5FdENEQloKli4x/v1+pKayGijaTkveQC06acs97np3RQ9rPpjrQ997Ff1aCK9EAS5tLv5um5H3H4luQTymFcsvb9rEvcU9HHKEGGlHRhPiXM68RX+dzMd3dlNcRx6ecnU6a3WPZ36FN85kz7pwuavKYAJkGgkcvBikd06hG1IenYe2wHtWH0JagytH54Hl28bi3/1j8zYK8RsAdkAkE99PGBumKnQERMS2nnWcsOsCZpkaKBd+U25iq82x3cJVfrJfRP+tisVITVQISJfPYHnl7E+dQWuuJ3nfKC+RjQLY8xN55VraF8azPg+k0tmJ3XvDJtO0Pl9Rk9tiuGFw6EsgHDOHg2D0sw5mzdnYEBrXJNMvRIXWggBEAEYASCAAigAOhJGAEEASgBKAFcAUwBSAEYAAABCIDEAMwBDADYANwA5ADcAOABDAEYAMABBADUAMQA4AAAASlZ8AEMAOgBGAF8AMgAwADIANAAxAC8AOQAyADIAOAA5ADEAfABFADoAQwBfADAALwAwAHwARgA6AEYAXwAyADAANAAyADEALwAyADAANAA3ADkAfAAAAFIOUwBZAFMAVABFAE0AAABoAHJAVwBpAG4AZABvAHcAcwAgADEAMAAgAEUAbgB0AGUAcgBwAHIAaQBzAGUAIABMAFQAUwBDACAAMgAwADIAMQAAAHoUVwBPAFIASwBHAFIATwBVAFAAAAA= ---SEKHMET---
URLs

  • http://o3n4bhhtybbtwqqs.onion/13C67978CF0A518

  • https://sekhmet.top/13C67978CF0A518

Signatures

  • Detected Egregor ransomware 1 IoCs
  • Egregor Ransomware

    Variant of the Sekhmet ransomware first seen in September 2020.

    ransomwareegregor
  • Egregor family
    egregor
  • Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky
  • Locky family
    locky
  • Sekhmet Ransomware

    Ransomware family active in the wild since early 2020.

    ransomwaresekhmet
  • Sekhmet family
    sekhmet
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 4 IoCs
  • Blocklisted process makes network request 18 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Sekhmet_30_03_2020_364KB.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3340
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:352
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:396
      • C:\Windows\syswow64\MsiExec.exe
        "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Users\Admin\AppData\Local\Temp\System Update\patch_may13869.dll"
        2⤵
        • Drops startup file
        • Blocklisted process makes network request
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3804
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4976

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e57fbe5.rbs
          • Path C:\Config.Msi\e57fbe5.rbs
          • Size 7KB
          • SHA256 54506e79f5d8b7108226e10c01f6964dcd384e63f0a113b749080246ca6ac922
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {ebbc241c-44bb-4318-8b6a-491057d642a6}_OnDiskSnapshotProp
          • Path C:\System Volume Information\SPP\OnlineMetadataCache\{ebbc241c-44bb-4318-8b6a-491057d642a6}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 c2f003666322de7a277b5e4df37c2d884f9bee62ea607bd5acde84974fbd3f54
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          patch_may13869.dll
          • Path C:\Users\Admin\AppData\Local\Temp\System Update\patch_may13869.dll
          • Size 707KB
          • SHA256 fceb299326ef4298a3c30e10b31d8c64f1369b182ac256d1eeaf148c1adcea8d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          e57fbe4.msi
          • Path C:\Windows\Installer\e57fbe4.msi
          • Size 364KB
          • SHA256 b2945f293ee3f68a97cc493774ff1e8818f104fb92ef9dbeead05a32fc7006ff
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          RECOVER-FILES.txt
          • Path F:\$RECYCLE.BIN\RECOVER-FILES.txt
          • Size 11KB
          • SHA256 5ecd2816429d43b7b0cdc0e264937d9ffc439245c0edff9a0c127f0350ed6fd2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/3804-13-0x0000000000FD0000-0x0000000000FF8000-memory.dmp
          Download

          memory/3804-20-0x0000000000FD0000-0x0000000000FF8000-memory.dmp
          Download