Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/02/2026, 00:01
General
- Target file.exe
- Size 5.8MB
- Sample260207-aa2pjagy7d
- SHA256 a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922
Malware Config
Extracted
-
ps1
-
exe.dropper
https://i.imgur.com/vu5qS42.png
Extracted
-
C:\Decryption Instructions.txt
- ---------- Zero Day Locker ---------- Your files have been encrypted using Zero Day Ransomware! They can only be decrypted by paying us a ransom in cryptocurrency. Encrypted files have the .zeroday extension. IMPORTANT: Do not modify or rename encrypted files, as they may become unrecoverable. Contact us at the following telegram contact to discuss payment. .me/praiukiu6 ---------- ZeroDayLocker ----------
Signatures
- Renames multiple (182) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://i.imgur.com/vu5qS42.png', 'C:\Users\Admin\AppData\Local\Temp\Wallpaper.png')"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); public static void Set(string path) { SystemParametersInfo(20, 0, path, 3); } }'; [Wallpaper]::Set('C:\Users\Admin\AppData\Local\Temp\Wallpaper.png')"2⤵
- Command and Scripting Interpreter: PowerShell
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ylqf142o\ylqf142o.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1037.tmp" "c:\Users\Admin\AppData\Local\Temp\ylqf142o\CSC6E95EEB35574455BACA6A381135E015.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Decryption Instructions.txt
powershell.exe.log
StartupProfileData-NonInteractive
RES1037.tmp
__PSScriptPolicyTest_orcweazt.dmc.ps1
ylqf142o.dll
CSC6E95EEB35574455BACA6A381135E015.TMP
ylqf142o.0.cs
ylqf142o.cmdline
memory/2700-1110-0x000002B89A510000-0x000002B89A520000-memory.dmp
memory/2700-1118-0x000002B89A510000-0x000002B89A520000-memory.dmp
memory/2700-1109-0x000002B89A510000-0x000002B89A520000-memory.dmp
memory/2700-1131-0x000002B89C2E0000-0x000002B89C2E8000-memory.dmp
memory/5800-1104-0x000001D5EDFD0000-0x000001D5EDFE0000-memory.dmp
memory/5800-1103-0x000001D5EDF00000-0x000001D5EDF22000-memory.dmp
memory/5800-1096-0x000001D5EDFD0000-0x000001D5EDFE0000-memory.dmp
memory/5800-1095-0x000001D5EDFD0000-0x000001D5EDFE0000-memory.dmp