Overview

overview

10

Static

static

3

Enc.exe

windows10-2004-x64

10

Enc.exe

windows11-21h2-x64

10

Resubmissions

14/11/2025, 15:05

251114-sgjreasmax10

07/11/2025, 12:47

251107-p1nypayrel10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Enc.exe.zip
  • Size 899KB
  • Sample251107-p1nypayrel
  • SHA256 364a6b2b4bd8cda1fc45de43ea091a304c6a8ce5d646b2d8767b6e4d73c02083
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta

Ransom Note
  • <html> <head> <meta charset='windows-1251'> <title>encrypted</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu='no'> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>ALL YOUR VALUABLE DATA WAS ENCRYPTED!</div> </div> <div class='bold'>due to a security problem with your PC. If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Write this ID in the title of your message:<span class='mark'>5E5E7C23</span></div> <div class='bold'>Faster support Write Us To The ID-Telegram:<span class='mark'>@Decryptor_run (https://t.me/Decryptor_run)</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul> Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is via the LocalBitcoins website. Register, click 'Buy bitcoins', and select a seller by payment method and price. <br><a href='https://localbitcoins.com'>https://localbitcoins.com</a> <br> Alternatively, find other places to buy Bitcoins and a beginners guide here: <br><a href='http://www.coindesk.com'>http://www.coindesk.com</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software; it may cause permanent data loss.</li> <li>Decryption using third parties may result in increased price (they add their fee) or you may become a victim of a scam.</li> </ul> </div> </body> </html>
Emails
URLs

  • https://t.me/Decryptor_run)</span></div>

Extracted

Path

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\readme.txt

Ransom Note
  • ALL YOUR VALUABLE DATA WAS ENCRYPTED! All your files were encrypted with strong crypto algorithm AES-256 + RSA-2048. Please be sure that your files are not broken and you can restore them today. If you really want to restore your files please write us to the e-mails: Faster support Write Us To The ID-Telegram: @Decryptor_run (https://t.me/Decryptor_run) [email protected] In subject line write your ID: 5E5E7C23 Important! Please send your message to all of our 3 e-mail addresses. This is really important because of delivery problems of some mail services! Important! If you haven't received a response from us within 24 hours, please try to use a different email service (Gmail, Yahoo, AOL, etc). Important! Please check your SPAM folder each time you wait for our response! If you find our email in the SPAM folder please move it to your Inbox. Important! We are always in touch and ready to help you as soon as possible! Attach up to 2 small encrypted files for free test decryption. Please note that the files you send us should not contain any valuable information. We will send you test decrypted files in our response for your confidence. Of course you will receive all the necessary instructions how to decrypt your files! Important! Please note that we are professionals and just doing our job! Please do not waste time and do not try to deceive us - it will result only in a price increase! We are always open for dialogue and ready to help you.
URLs

  • https://t.me/Decryptor_run

Extracted

Path

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\readme.txt

Ransom Note
  • ALL YOUR VALUABLE DATA WAS ENCRYPTED! All your files were encrypted with strong crypto algorithm AES-256 + RSA-2048. Please be sure that your files are not broken and you can restore them today. If you really want to restore your files please write us to the e-mails: Faster support Write Us To The ID-Telegram: @Decryptor_run (https://t.me/Decryptor_run) [email protected] In subject line write your ID: 13828828 Important! Please send your message to all of our 3 e-mail addresses. This is really important because of delivery problems of some mail services! Important! If you haven't received a response from us within 24 hours, please try to use a different email service (Gmail, Yahoo, AOL, etc). Important! Please check your SPAM folder each time you wait for our response! If you find our email in the SPAM folder please move it to your Inbox. Important! We are always in touch and ready to help you as soon as possible! Attach up to 2 small encrypted files for free test decryption. Please note that the files you send us should not contain any valuable information. We will send you test decrypted files in our response for your confidence. Of course you will receive all the necessary instructions how to decrypt your files! Important! Please note that we are professionals and just doing our job! Please do not waste time and do not try to deceive us - it will result only in a price increase! We are always open for dialogue and ready to help you.
URLs

  • https://t.me/Decryptor_run

Extracted

Path

  • C:\Users\Admin\Desktop\info.hta

Ransom Note
  • ALL YOUR VALUABLE DATA WAS ENCRYPTED! due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message: 13828828 Faster support Write Us To The ID-Telegram: @Decryptor_run (https://t.me/Decryptor_run) You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. How to obtain Bitcoins The easiest way to buy bitcoins is via the LocalBitcoins website. Register, click 'Buy bitcoins', and select a seller by payment method and price. https://localbitcoins.com Alternatively, find other places to buy Bitcoins and a beginners guide here: http://www.coindesk.com Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software; it may cause permanent data loss. Decryption using third parties may result in increased price (they add their fee) or you may become a victim of a scam.
URLs

  • https://t.me/Decryptor_run

Targets

    • Target
      Enc.exe.bin
    • Size 935KB
    • SHA256 cffed3d215b10a5766d23893a69418d465ae0dc59fdb73036ca96bc63bf0f524
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    credential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (12106) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Disables Task Manager via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks