hellokitty | bdb19d9eb19343708fbcc36acfaa91699e89d68643c75bf90c6d1e57adaf0d3d

Analysis

max time kernel
103s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2025, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdb19d9eb19343708fbcc36acfaa91699e89d68643c75bf90c6d1e57adaf0d3d.exe
Size

153KB
MD5

019b65ccaabcf519b65645284966db57
SHA1

76fbee514ec7d0b666b10ebfa98bc3197ebde8cd
SHA256

bdb19d9eb19343708fbcc36acfaa91699e89d68643c75bf90c6d1e57adaf0d3d
SHA512

09c0c819873498f6d6e3a3d1db94cefd6427c380ba74cd31d185c130934fa92918fef05b5737b96a96b0c7ba2f197d562bbf568d7af540a2f5ae6de93e2df827
SSDEEP

1536:oeTqb5QIul2hD/S8+5hFg2NRrlSYDLGRxHwEEaY4qr6leWvebuFD0MCu7sWZcdGv:Kb45hmjqGR2l/mlHaMwGkHJhqjLcCl

Score

10^/10

hellokitty discovery ransomware

Malware Config

Extracted

Path

C:\Recovery\read_me_lkdtt.txt

Ransom Note

Hello CEMIG! All your fileservers, HyperV infrastructure and backups have been encrypted! Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data! The only way to recover your files is by cooperating with us. To prove our seriousness, we can decrypt 1 non-critical file for free as proof. We have over 10 TB data of your private files, databases, personal data... etc, you have 24 hours to contact us, another way we publish this information in public channels, and this site will be unavailable. -- Contact with us by method below 1) Open this website in TOR browser: http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692 2) Follow instructions in chat.

URLs

http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692

Signatures

HelloKitty Ransomware
Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.
ransomware hellokitty
Hellokitty family
hellokitty
Renames multiple (150) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	bdb19d9eb19343708fbcc36acfaa91699e89d68643c75bf90c6d1e57adaf0d3d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdb19d9eb19343708fbcc36acfaa91699e89d68643c75bf90c6d1e57adaf0d3d.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	4204	vssvc.exe
Token: SeRestorePrivilege	4204	vssvc.exe
Token: SeAuditPrivilege	4204	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bdb19d9eb19343708fbcc36acfaa91699e89d68643c75bf90c6d1e57adaf0d3d.exe
"C:\Users\Admin\AppData\Local\Temp\bdb19d9eb19343708fbcc36acfaa91699e89d68643c75bf90c6d1e57adaf0d3d.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:4468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\read_me_lkdtt.txt

Filesize
1KB

MD5
039d96e315e46c95b340887c1376d31a

SHA1
e4c03b1f13710f9888bbd554ffef8ec2f5bc438e

SHA256
e9f4ecd100413d581c14bed13ad22c9448035b0a04bacaafdf9a50edf5546c68

SHA512
cbe6929c548fc8d5650b67bab0c6effcd1cf95e0f472db4628dedd1a3920ad5a985bfdfcc6a19975529e8e3dbbfa8d36ed41548fd999c119110a00e9695526da

Download Submit