Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/03/2026, 03:33
General
- Target a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922.exe
- Size 5.8MB
- Sample260305-d4ecwabs2r
- SHA256 a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922
Malware Config
Extracted
-
ps1
-
exe.dropper
https://i.imgur.com/vu5qS42.png
Extracted
-
C:\Decryption Instructions.txt
- ---------- Zero Day Locker ---------- Your files have been encrypted using Zero Day Ransomware! They can only be decrypted by paying us a ransom in cryptocurrency. Encrypted files have the .zeroday extension. IMPORTANT: Do not modify or rename encrypted files, as they may become unrecoverable. Contact us at the following telegram contact to discuss payment. .me/praiukiu6 ---------- ZeroDayLocker ----------
Signatures
- Renames multiple (185) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922.exe"C:\Users\Admin\AppData\Local\Temp\a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://i.imgur.com/vu5qS42.png', 'C:\Users\Admin\AppData\Local\Temp\Wallpaper.png')"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); public static void Set(string path) { SystemParametersInfo(20, 0, path, 3); } }'; [Wallpaper]::Set('C:\Users\Admin\AppData\Local\Temp\Wallpaper.png')"2⤵
- Command and Scripting Interpreter: PowerShell
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iwqg3cbn\iwqg3cbn.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D93.tmp" "c:\Users\Admin\AppData\Local\Temp\iwqg3cbn\CSCE087242A7EAA4E81AD2ADDBD599E1A97.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Decryption Instructions.txt
powershell.exe.log
StartupProfileData-NonInteractive
RES2D93.tmp
__PSScriptPolicyTest_p3s5abvs.nkk.ps1
iwqg3cbn.dll
CSCE087242A7EAA4E81AD2ADDBD599E1A97.TMP
iwqg3cbn.0.cs
iwqg3cbn.cmdline
memory/1096-1138-0x00000226F0580000-0x00000226F058C000-memory.dmp
memory/1452-1110-0x000002327D4E0000-0x000002327D4F0000-memory.dmp
memory/1452-1115-0x000002327D360000-0x000002327D372000-memory.dmp
memory/1452-1114-0x00000232634A0000-0x00000232634AC000-memory.dmp
memory/1452-1109-0x000002327D3B0000-0x000002327D3D2000-memory.dmp
memory/1452-1101-0x000002327D4E0000-0x000002327D4F0000-memory.dmp
memory/1452-1102-0x000002327D4E0000-0x000002327D4F0000-memory.dmp
memory/1792-1135-0x000002A80F470000-0x000002A80F47C000-memory.dmp
memory/3336-1125-0x00000138A94E0000-0x00000138A94F0000-memory.dmp
memory/3336-1117-0x00000138A94E0000-0x00000138A94F0000-memory.dmp
memory/3336-1140-0x00000138A9600000-0x00000138A9608000-memory.dmp
memory/3336-1142-0x00000138A7920000-0x00000138A792C000-memory.dmp
memory/3336-1143-0x00000138A94F0000-0x00000138A9502000-memory.dmp