Analysis
- max time kernel
35s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system - submitted
04/12/2025, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
newfile/noexe.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
newfile/noexe.exe
Resource
win11-20251015-en
windows11-21h2-x64
10 signatures
300 seconds
General
- Target newfile/noexe.exe
- Size 1.7MB
- Sample251204-2b647avncx
- SHA256 4a1df9561c00baaa5ece3cca3f681d64b8ae4cdcdde65ea23cc32f89ced524c8
- MD5 d09e29f6886c27d52e63befa5ee62dab
- SHA1 ec655101ba5ee7b4eaf15ef1c85c327a71f73de0
- SHA512 a226dd2556bbfc1a4cf9e98b16df401a17d90b283db35ce5f268e7a20481b98169e1e6a74844a15b7a88f95c5a8121f7573e16cdc04bccb1488ac9f5a2aa27b9
- SSDEEP 24576:RrYottM3V52zhP+427kZVl1bXCS9KlRjW3Z9ZrUv7TVzc6IIA0JlupmSydRd/xiK:REtpQ9avfVJYm7FUfTty
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\ProgramData\readme.txt
-
devman
Ransom Note
- Good afternoon, As you can see you have been attacked by a ransomware program! We The DragonForce Ransomware Cartel offer you to make a deal with us. We can make a deal with you, all you need to do is contact us by following the instructions below. We are in no way connected to politics, we always keep our word. You have a chance to decrypt your files and avoid being published on our blog! Use this opportunity and also don't waste your time. The approximate date of deletion of the decryptor program, as well as publication on our blog 05/12/2025 00:00 UTC. - # 1 Communication Process, In order to contact us you need to click on the special link below, which is listed in #2. After that the negotiation process begins, in which you have the opportunity to request several things from us, 1. make a test decrypt. 2. get a list of the files stolen from you. At the conclusion of our negotiations we agree on a price, we set the price ourselves based on your income/your insurance. We scrutinize your documents and are well aware of how much income your company has per year. - # 2 Access to the meeting room, To access us please download Tor Browser which is available here. (https://www.torproject.org/) Once you download the special anonymous browser you need to follow this link, http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion Your unique ID: AB5EF26B7646383DAB5EF26B7646383D - use it to enter our meeting room. - # 3 Additional Support Contacts, Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 - # 4 Recommendations, Do not try to recover your files with third-party programs, you will only do harm. Do not turn off / reboot your computer. Be courteous in our meeting room. Do not procrastinate. - # 5 Blog and News, Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion DragonNews: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/news
URLs
-
http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
-
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
-
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/news
Signatures
- Devman
Devman is a ransomware forked from the DragonForce ransomware.
- Devman family
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops desktop.ini file(s) 17 IoCs
description ioc Process File opened for modification C:\Users\Admin\Links\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini noexe.exe File opened for modification C:\Program Files (x86)\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini noexe.exe File opened for modification C:\Program Files\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Documents\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Searches\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Videos\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Music\desktop.ini noexe.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini noexe.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini noexe.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms noexe.exe File created C:\Program Files (x86)\Common Files\System\msadc\readme.txt noexe.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.rll noexe.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl noexe.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\readme.txt noexe.exe File opened for modification C:\Program Files\desktop.ini noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX noexe.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\readme.txt noexe.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\readme.txt noexe.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\readme.txt noexe.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt noexe.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jawt.h noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms noexe.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\readme.txt noexe.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar noexe.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms noexe.exe File created C:\Program Files\VideoLAN\VLC\locale\id\readme.txt noexe.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN111.XML noexe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\readme.txt noexe.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms noexe.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.catalog noexe.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt noexe.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT noexe.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\readme.txt noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005 noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms noexe.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\readme.txt noexe.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms noexe.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\dom.md noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4 noexe.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms noexe.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language noexe.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe 240 noexe.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 392 vssvc.exe Token: SeRestorePrivilege 392 vssvc.exe Token: SeAuditPrivilege 392 vssvc.exe Token: SeIncreaseQuotaPrivilege 2576 WMIC.exe Token: SeSecurityPrivilege 2576 WMIC.exe Token: SeTakeOwnershipPrivilege 2576 WMIC.exe Token: SeLoadDriverPrivilege 2576 WMIC.exe Token: SeSystemProfilePrivilege 2576 WMIC.exe Token: SeSystemtimePrivilege 2576 WMIC.exe Token: SeProfSingleProcessPrivilege 2576 WMIC.exe Token: SeIncBasePriorityPrivilege 2576 WMIC.exe Token: SeCreatePagefilePrivilege 2576 WMIC.exe Token: SeBackupPrivilege 2576 WMIC.exe Token: SeRestorePrivilege 2576 WMIC.exe Token: SeShutdownPrivilege 2576 WMIC.exe Token: SeDebugPrivilege 2576 WMIC.exe Token: SeSystemEnvironmentPrivilege 2576 WMIC.exe Token: SeRemoteShutdownPrivilege 2576 WMIC.exe Token: SeUndockPrivilege 2576 WMIC.exe Token: SeManageVolumePrivilege 2576 WMIC.exe Token: 33 2576 WMIC.exe Token: 34 2576 WMIC.exe Token: 35 2576 WMIC.exe Token: 36 2576 WMIC.exe Token: SeIncreaseQuotaPrivilege 2576 WMIC.exe Token: SeSecurityPrivilege 2576 WMIC.exe Token: SeTakeOwnershipPrivilege 2576 WMIC.exe Token: SeLoadDriverPrivilege 2576 WMIC.exe Token: SeSystemProfilePrivilege 2576 WMIC.exe Token: SeSystemtimePrivilege 2576 WMIC.exe Token: SeProfSingleProcessPrivilege 2576 WMIC.exe Token: SeIncBasePriorityPrivilege 2576 WMIC.exe Token: SeCreatePagefilePrivilege 2576 WMIC.exe Token: SeBackupPrivilege 2576 WMIC.exe Token: SeRestorePrivilege 2576 WMIC.exe Token: SeShutdownPrivilege 2576 WMIC.exe Token: SeDebugPrivilege 2576 WMIC.exe Token: SeSystemEnvironmentPrivilege 2576 WMIC.exe Token: SeRemoteShutdownPrivilege 2576 WMIC.exe Token: SeUndockPrivilege 2576 WMIC.exe Token: SeManageVolumePrivilege 2576 WMIC.exe Token: 33 2576 WMIC.exe Token: 34 2576 WMIC.exe Token: 35 2576 WMIC.exe Token: 36 2576 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 240 wrote to memory of 2920 240 noexe.exe 81 PID 2920 wrote to memory of 2576 2920 cmd.exe 83 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\newfile\noexe.exe"C:\Users\Admin\AppData\Local\Temp\newfile\noexe.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BD5E4862-5F4F-4282-A75E-E5EF5EAF5B86}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BD5E4862-5F4F-4282-A75E-E5EF5EAF5B86}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\readme.txt
- Size 1KB
- SHA256 fbdad1b9aab559188ed29f4b7736ec4304afd405110c5658f01975ac8e8fbc14
- MD5 87c7cbdffba118f406b37ccee7c41985
- SHA1 36b0374f4438b9df4c180fa9c7b9a3d2c6cdc99e
- SHA512 d0467f725d7215112c537d116793d05768e264dbb0109db29a6b8a44185ab031829a9fdb8515af47df64276772e1a1dfd6e0d7aad1890bf79257c7f0a4882703
- MD5 SHA1 SHA512