Overview

overview

10

Static

static

3

4ed176edb7...29.exe

windows10-2004-x64

10

4ed176edb7...29.exe

windows11-21h2-x64

10

Resubmissions

30/04/2026, 02:38

260430-c45dmad19j10

18/10/2025, 02:40

251018-c56cbag16d10

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251015-en
  • resource tags

    arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/10/2025, 02:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe
  • Size 1.8MB
  • Sample251018-c56cbag16d
  • SHA256 4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwarecredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\fucked_icon\READ_ME_NOW.txt

Ransom Note
  • / # Hello, if you are seeing this then you have been attacked by Kyber Ransomware. \ <=> Your files are encrypted with the AES-256-CTR algorithm. >-- (Explanation) https://en.wikipedia.org/wiki/Advanced_Encryption_Standard <=> Two asymmetric algorithms X25519 and Kyber1024 were used for key generation. >-- (Explanation) https://en.wikipedia.org/wiki/Curve25519 >-- (Explanation) https://en.wikipedia.org/wiki/Kyber <=> Keys are created from several random sources, so do not hope that you will return the files without our help >-- (Explanation) https://en.wikipedia.org/wiki//dev/random >-- (Explanation) https://en.wikipedia.org/wiki/RDRAND >-- (Explanation) https://en.wikipedia.org/wiki/HKDF (??WE HAVE A FLASH DRIVE WITH BACKUPS ON THE ADMIN'S NECK??) >======================================================================================== > In addition to encrypting files, a lot of data has been downloaded from your network. > If you don't write to us, within a week or two your name will end up on our > blog with example of important data. >======================================================================================== (??CAN WE TRUST HACKERS??) >======================================================================================== > If you come to our chat room, you can count on free decryption for three small files. > and examples of the downloaded data. >======================================================================================== (??WE DON'T HAVE VALUABLE DATA??) >======================================================================================== > We take a responsible approach to doing our job. > We have probably downloaded a lot of personal information from your servers, and could > cause you HUGE problems by publishing it. # Documents such as payroll, statements, contracts and others may contain valuable data, # the publication of which could lead to lawsuits. >======================================================================================== (??WILL THE POLICE HELP??) >======================================================================================== > DO NOT try to call the police as they will not save you from > publishing your data, nor will they help you get your files back, > they will only ban you from paying. >======================================================================================== (??WHAT IF I TRIED TO TRICK YOU???) >======================================================================================== > DO NOT modify the files, you may damage them and make it so > we can't help you. >======================================================================================== (??WHAT ABOUT THE ANONYMITY??) >======================================================================================== > We create unique links to anonymous chat for each company. > you don't have to worry, all the details of our deal will be kept secret. > We also have alternative ways to contact us if you are worried and do > not want to write in the panel. >======================================================================================== HOW TO CONTACT US: <=> Download Tor Browser (https://www.torproject.org/download) <=> Open it <=> Follow this link: http://mlnmlnnrdhcaddwll4zqvfd2vyqsgtgj473gjoehwna2v4sizdukheyd.onion/chat/f9e1d038b1f5220e888b56e97881937f (Also maybe you would like to visit our blog? Don't be shy!) <=> Blog: http://kyblogtz6k3jtxnjjvluee5ec4g3zcnvyvbgsnq5thumphmqidkt7xid.onion
URLs

  • http://mlnmlnnrdhcaddwll4zqvfd2vyqsgtgj473gjoehwna2v4sizdukheyd.onion/chat/f9e1d038b1f5220e888b56e97881937f

  • http://kyblogtz6k3jtxnjjvluee5ec4g3zcnvyvbgsnq5thumphmqidkt7xid.onion

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (2755) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 27 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe
    "C:\Users\Admin\AppData\Local\Temp\4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe"
    1⤵
    • Drops startup file
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "vssadmin.exe Delete Shadows /all /quiet"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe Delete Shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:5112
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "powershell -ep bypass -nop -c \"Get-WmiObject -Class Win32_ShadowCopy | ForEach-Object { $_.Delete() }\""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1800
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ep bypass -nop -c \"Get-WmiObject -Class Win32_ShadowCopy | ForEach-Object { $_.Delete() }\"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4468
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "wmic.exe SHADOWCOPY DELETE /nointeractive"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5252
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic.exe SHADOWCOPY DELETE /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4444
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "bcdedit.exe /set {default} recoveryenabled No"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4936
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1020
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4340
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "wbadmin DELETE SYSTEMSTATEBACKUP"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3732
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP
        3⤵
        • Deletes System State backups
        PID:1184
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:5032
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C "iisreset.exe /stop"
      2⤵
        PID:2236
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /C "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Windows\system32\reg.exe
          reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
          3⤵
            PID:5048
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /C "for /F \"tokens=*\" %i in ('wevtutil el') do wevtutil cl \"%i\""
          2⤵
            PID:5180
          • C:\Windows\system32\cmd.exe
            "cmd.exe" /C "rd /s /q C:\$Recycle.Bin"
            2⤵
              PID:5092
            • C:\Windows\system32\ie4uinit.exe
              "ie4uinit.exe" -show
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Modifies Internet Explorer settings
              • Modifies registry class
              PID:4484
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2360
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:5456

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Windows Management Instrumentation

                1
                T1047

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Active Setup

                1
                T1547.014

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Active Setup

                1
                T1547.014

                Defense Evasion

                Direct Volume Access

                1
                T1006

                Indicator Removal

                3
                T1070

                File Deletion

                3
                T1070.004

                Modify Registry

                2
                T1112

                Credential Access

                Credentials from Password Stores

                2
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Windows Credential Manager

                1
                T1555.004

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                System Information Discovery

                1
                T1082

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Inhibit System Recovery

                4
                T1490

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                {3B43DED5-E3AE-4F35-87AC-D9F39886E68A}.2.ver0x0000000000000001.db.#~~~
                • Path C:\ProgramData\Microsoft\Windows\Caches\{3B43DED5-E3AE-4F35-87AC-D9F39886E68A}.2.ver0x0000000000000001.db.#~~~
                • Size 3KB
                • SHA256 067a310bfa788c3ef73310f434b3ba77022d4449e4f1763a95a198029bdd539c
                • MD5 SHA1 SHA512
                Submit Download

                {DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.#~~~
                • Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.#~~~
                • Size 626KB
                • SHA256 4e8a303e6fb6ce1b176bb9cebb477a5241adc6afbcc4609d925bfdd62360e284
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 9c39f3e1ee674a289926fddddfc5549740c488686ec6513f53848a225c192ba6
                • MD5 SHA1 SHA512
                Submit Download

                iecompatdata.xml
                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml
                • Size 2KB
                • SHA256 c5fb79289e4120352c3d011ea7cd3d52ebe3498437cfd6b14fe40506e7d3b94e
                • MD5 SHA1 SHA512
                Submit Download

                ie4uinit-show.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\ie4uinit-show.log
                • Size 976B
                • SHA256 1a0cef66fa860034e5507b0c30a5b6e11b27a7ce694ca79aa51db4543f74570d
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 64B
                • SHA256 8ff32c0be04cd2af2b9cd5ddb61d74c94af99a9ebad6a57b0e4f3f7896ef7225
                • MD5 SHA1 SHA512
                Submit Download

                __PSScriptPolicyTest_ipib0j3a.jpw.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ipib0j3a.jpw.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512
                Submit Download

                READ_ME_NOW.txt
                • Path C:\fucked_icon\READ_ME_NOW.txt
                • Size 3KB
                • SHA256 ef054d22823758290db94aab3c901471a9ebd633f94963030806cc68dd433d8d
                • MD5 SHA1 SHA512
                Submit Download

                memory/4468-9-0x000001BFD98D0000-0x000001BFD98F2000-memory.dmp
                Download