Overview

overview

10

Static

static

3

4ed176edb7...29.exe

windows10-2004-x64

10

4ed176edb7...29.exe

windows11-21h2-x64

10

Resubmissions

30/04/2026, 02:38

260430-c45dmad19j10

18/10/2025, 02:40

251018-c56cbag16d10

Analysis

  • max time kernel
    149s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20251016-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2025, 02:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe
  • Size 1.8MB
  • Sample251018-c56cbag16d
  • SHA256 4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwarecredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\fucked_icon\READ_ME_NOW.txt

Ransom Note
  • / # Hello, if you are seeing this then you have been attacked by Kyber Ransomware. \ <=> Your files are encrypted with the AES-256-CTR algorithm. >-- (Explanation) https://en.wikipedia.org/wiki/Advanced_Encryption_Standard <=> Two asymmetric algorithms X25519 and Kyber1024 were used for key generation. >-- (Explanation) https://en.wikipedia.org/wiki/Curve25519 >-- (Explanation) https://en.wikipedia.org/wiki/Kyber <=> Keys are created from several random sources, so do not hope that you will return the files without our help >-- (Explanation) https://en.wikipedia.org/wiki//dev/random >-- (Explanation) https://en.wikipedia.org/wiki/RDRAND >-- (Explanation) https://en.wikipedia.org/wiki/HKDF (??WE HAVE A FLASH DRIVE WITH BACKUPS ON THE ADMIN'S NECK??) >======================================================================================== > In addition to encrypting files, a lot of data has been downloaded from your network. > If you don't write to us, within a week or two your name will end up on our > blog with example of important data. >======================================================================================== (??CAN WE TRUST HACKERS??) >======================================================================================== > If you come to our chat room, you can count on free decryption for three small files. > and examples of the downloaded data. >======================================================================================== (??WE DON'T HAVE VALUABLE DATA??) >======================================================================================== > We take a responsible approach to doing our job. > We have probably downloaded a lot of personal information from your servers, and could > cause you HUGE problems by publishing it. # Documents such as payroll, statements, contracts and others may contain valuable data, # the publication of which could lead to lawsuits. >======================================================================================== (??WILL THE POLICE HELP??) >======================================================================================== > DO NOT try to call the police as they will not save you from > publishing your data, nor will they help you get your files back, > they will only ban you from paying. >======================================================================================== (??WHAT IF I TRIED TO TRICK YOU???) >======================================================================================== > DO NOT modify the files, you may damage them and make it so > we can't help you. >======================================================================================== (??WHAT ABOUT THE ANONYMITY??) >======================================================================================== > We create unique links to anonymous chat for each company. > you don't have to worry, all the details of our deal will be kept secret. > We also have alternative ways to contact us if you are worried and do > not want to write in the panel. >======================================================================================== HOW TO CONTACT US: <=> Download Tor Browser (https://www.torproject.org/download) <=> Open it <=> Follow this link: http://mlnmlnnrdhcaddwll4zqvfd2vyqsgtgj473gjoehwna2v4sizdukheyd.onion/chat/f9e1d038b1f5220e888b56e97881937f (Also maybe you would like to visit our blog? Don't be shy!) <=> Blog: http://kyblogtz6k3jtxnjjvluee5ec4g3zcnvyvbgsnq5thumphmqidkt7xid.onion
URLs

  • http://mlnmlnnrdhcaddwll4zqvfd2vyqsgtgj473gjoehwna2v4sizdukheyd.onion/chat/f9e1d038b1f5220e888b56e97881937f

  • http://kyblogtz6k3jtxnjjvluee5ec4g3zcnvyvbgsnq5thumphmqidkt7xid.onion

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (2666) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 27 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe
    "C:\Users\Admin\AppData\Local\Temp\4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe"
    1⤵
    • Drops startup file
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "vssadmin.exe Delete Shadows /all /quiet"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe Delete Shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:5136
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "powershell -ep bypass -nop -c \"Get-WmiObject -Class Win32_ShadowCopy | ForEach-Object { $_.Delete() }\""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4448
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ep bypass -nop -c \"Get-WmiObject -Class Win32_ShadowCopy | ForEach-Object { $_.Delete() }\"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1408
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "wmic.exe SHADOWCOPY DELETE /nointeractive"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4480
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic.exe SHADOWCOPY DELETE /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5532
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "bcdedit.exe /set {default} recoveryenabled No"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5252
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5264
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "wbadmin DELETE SYSTEMSTATEBACKUP"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4516
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:5168
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4992
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        3⤵
        • Deletes System State backups
        PID:5564
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "iisreset.exe /stop"
      2⤵
        PID:3576
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /C "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5408
        • C:\Windows\system32\reg.exe
          reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
          3⤵
            PID:5132
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /C "for /F \"tokens=*\" %i in ('wevtutil el') do wevtutil cl \"%i\""
          2⤵
            PID:1708
          • C:\Windows\system32\cmd.exe
            "cmd.exe" /C "rd /s /q C:\$Recycle.Bin"
            2⤵
              PID:4844
            • C:\Windows\system32\ie4uinit.exe
              "ie4uinit.exe" -show
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Modifies Internet Explorer settings
              • Modifies registry class
              PID:2056
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5076
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:5164

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Windows Management Instrumentation

                1
                T1047

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Active Setup

                1
                T1547.014

                Event Triggered Execution

                1
                T1546

                Component Object Model Hijacking

                1
                T1546.015

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Active Setup

                1
                T1547.014

                Event Triggered Execution

                1
                T1546

                Component Object Model Hijacking

                1
                T1546.015

                Defense Evasion

                Direct Volume Access

                1
                T1006

                Indicator Removal

                3
                T1070

                File Deletion

                3
                T1070.004

                Modify Registry

                2
                T1112

                Credential Access

                Credentials from Password Stores

                2
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Windows Credential Manager

                1
                T1555.004

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Inhibit System Recovery

                4
                T1490

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                {0744DAF6-AE70-4E1F-9FF2-1068CCEB79D6}.2.ver0x0000000000000001.db.#~~~
                • Path C:\ProgramData\Microsoft\Windows\Caches\{0744DAF6-AE70-4E1F-9FF2-1068CCEB79D6}.2.ver0x0000000000000001.db.#~~~
                • Size 3KB
                • SHA256 83b5d8b34ecb66d0dd80c45ca7790dd50dac99b5a7e9785f24edb51f9e076504
                • MD5 SHA1 SHA512
                Submit Download

                {DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.#~~~
                • Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.#~~~
                • Size 624KB
                • SHA256 4664333979062d491c2179828f08e7bcb2d56868a095599a9e6efc4385cda651
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                • MD5 SHA1 SHA512
                Submit Download

                ie4uinit-show.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\ie4uinit-show.log
                • Size 654B
                • SHA256 4bc0e455b593e6fe28efefc6b79850648b2ffbb845f8d77a8e75f8df03351917
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 64B
                • SHA256 e01c06d94e15689c6f1df12a7c01e8c99b16e693bff41af88917a31b93cc1bf0
                • MD5 SHA1 SHA512
                Submit Download

                __PSScriptPolicyTest_x5qevwqf.2xc.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x5qevwqf.2xc.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512
                Submit Download

                READ_ME_NOW.txt
                • Path C:\fucked_icon\READ_ME_NOW.txt
                • Size 3KB
                • SHA256 ef054d22823758290db94aab3c901471a9ebd633f94963030806cc68dd433d8d
                • MD5 SHA1 SHA512
                Submit Download

                memory/1408-9-0x00000271D8E60000-0x00000271D8E82000-memory.dmp
                Download