Analysis
- max time kernel
148s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/04/2026, 19:55
General
- Target daa4dbcccf9d44a832df373d4f9637e6979d53cba1adbaf42da246a8b7731b84.exe
- Size 2.9MB
- Sample260405-ynbbhafs61
- SHA256 daa4dbcccf9d44a832df373d4f9637e6979d53cba1adbaf42da246a8b7731b84
Malware Config
Extracted
-
C:\$Recycle.Bin\DECRYPT-FILES.txt
- ======================================================== What happened? ======================================================== Greetings, JM Bozeman Enterprises! Your IT infrastructure has been compromised. All your data has been exfiltrated, encrypted, and infected, and will be analyzed using our proprietary artificial intelligence model, trained to identify the most sensitive information. All your computers are now infected with file-infecting software that will re-initiate encryption every time new data is created on your machines. This is a novel technique, and you can take pride in being the first in history to encounter it. ======================================================== What can you do? ======================================================== Options are limited. One option is to attempt restoration on your own, but you will face significant obstacles during this process while the file infector remains active in the network. Additionally, you will have to deal with the publication of a blog post containing your data, analyzed by our AI. This will include a useful breakdown of sensitive data that can be utilized by other threat actors, both cyber and physical. This is particularly critical given the fact that you are a logistics company. ======================================================== How can you be sure that we are trustworthy? ======================================================== Simply communicate with us, and you will understand the situation. You may also request a list of the downloaded data that is currently being analyzed. ======================================================== How to contact us? ======================================================== To get in touch with us, you can use the links below. - https://secp0-support.cfd/040da5/f32b4269996fb177e6189640 - http://bhn2xz5jer2xeibxjzhgfp7qclttnbvkkvd4hvlmjbnz66jxq7yzn6ad.onion/040da5/f32b4269996fb177e6189640 - http://2a6w667vebiebciji7vm3vj43svegvozoqypttdgojzgdcbnfsu5wiid.onion/040da5/f32b4269996fb177e6189640 To access the onion link, you'll need to download and install the Tor Browser (https://www.torproject.org/download). ======================================================== How do we differ from average ransomware actors? ======================================================== You may be advised by recovery companies not to make contact with us. Usually, data publication is not considered highly dangerous for a company because it is impossible to download all data due to Tor network outages and slowdowns. However, that is not the case with us. We will provide a special breakdown of your company using our AI analysis tool on our data leakage website. This site is designed specifically to operate over TOR without slowdowns, featuring a useful file browser that provides contents in real-time without delay, eliminating the need to download useless data. You can view this using the links below in the OUR BLOG section, featuring different companies on which we have tested our AI. Furthermore, as we have stated, this is the first time in history that file-infecting software has been used for persistence. Usually, it is simple to roll back backups and resolve the issue; however, in this case, the persistence is very deep. We possess a special cryptographically signed file that can switch the infection off, along with a special cure utility that can clean all your infected files, stopping the persistent re-encryption of your data. You can go to the media and become famous, just like the first victims of the so-called 'Big Game Hunting' ransomware groups. However, do you actually need it? ======================================================== Out blog ======================================================== - https://secp0-news.ws - http://secponewsxgrlnirowclps2kllzaotaf5w2bsvktdnz4qhjr2jnwvvyd.onion To access the onion link, you'll need to download and install the Tor Browser (https://www.torproject.org/download). ---BELOW IS TECHNICAL INFORMATION REQUIRED FOR US TO PROVIDE YOU WITH DECRYPTION TOOL, DO NOT REDACT--- data_begin 9TKFS2biLaw9405UDxlpLsnL6qm5dQZLV6HsmjQ8VbkDpya/EmMDw+WN1u6oUTsNLoy2DRvzZ0vjwyuPBAyD1qgDjXcnr+UULAzN2+z6d7t8R2TImjDmLHvbcp0+vu29dy0DKZadV3h1UXStfiR+2lR+F1jXEslPW+QJxiYpeqk/uPIJAAAAAQAAAGYAMwAyAGIANAAyADYAOQA5ADkANgBmAGIAMQA3ADcAZQA2ADEAOAA5ADYANAAwAAAAAAAAAAAAAAAAAAAAAABXAE8AUgBLAEcAUgBPAFUAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== data_end ---FINISH---
-
https://secp0-support.cfd/040da5/f32b4269996fb177e6189640
-
http://bhn2xz5jer2xeibxjzhgfp7qclttnbvkkvd4hvlmjbnz66jxq7yzn6ad.onion/040da5/f32b4269996fb177e6189640
-
http://2a6w667vebiebciji7vm3vj43svegvozoqypttdgojzgdcbnfsu5wiid.onion/040da5/f32b4269996fb177e6189640
-
https://secp0-news.ws
-
http://secponewsxgrlnirowclps2kllzaotaf5w2bsvktdnz4qhjr2jnwvvyd.onion
Signatures
- Maze
Ransomware family also known as ChaCha.
- Maze family
- Renames multiple (2611) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\daa4dbcccf9d44a832df373d4f9637e6979d53cba1adbaf42da246a8b7731b84.exe"C:\Users\Admin\AppData\Local\Temp\daa4dbcccf9d44a832df373d4f9637e6979d53cba1adbaf42da246a8b7731b84.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
DECRYPT-FILES.txt
deployment.properties
deployment.properties
baseline.versions
blacklist.dynamic
blacklisted.certs
securitypack.jar
securitypack.jar
update.securitypack.timestamp
jusched.log
83aa4cc77f591dfc2374580bbd95f6ba_1a790b84-0b0c-402b-8e4d-eaf1970df9ef
memory/3956-12-0x00000000028F0000-0x000000000291C000-memory.dmp
memory/3956-394-0x00000000042E0000-0x0000000004344000-memory.dmp
memory/3956-8126-0x0000000000400000-0x00000000008B9000-memory.dmp
memory/3956-21-0x0000000002BF0000-0x0000000002C1F000-memory.dmp
memory/3956-0-0x0000000000400000-0x00000000008B9000-memory.dmp
memory/3956-8125-0x00000000042E0000-0x0000000004344000-memory.dmp
memory/3956-2-0x0000000002740000-0x000000000275E000-memory.dmp
memory/3956-4-0x0000000002740000-0x000000000275E000-memory.dmp
memory/3956-3-0x0000000002720000-0x0000000002721000-memory.dmp
memory/3956-5-0x00000000028F0000-0x000000000291C000-memory.dmp
memory/3956-11-0x0000000002BF0000-0x0000000002C1F000-memory.dmp
memory/3956-7-0x0000000002BF0000-0x0000000002C1F000-memory.dmp
memory/3956-182-0x0000000000400000-0x00000000008B9000-memory.dmp
memory/4968-93-0x000001F561F30000-0x000001F561F31000-memory.dmp
memory/4968-60-0x000001F561F30000-0x000001F561F31000-memory.dmp
memory/4968-181-0x000001F57D5D0000-0x000001F57D5E2000-memory.dmp
memory/4968-180-0x000001F57D3C0000-0x000001F57D3CC000-memory.dmp
memory/4968-179-0x000001F561F30000-0x000001F561F31000-memory.dmp
memory/4968-78-0x000001F561F30000-0x000001F561F31000-memory.dmp
memory/4968-155-0x000001F561F30000-0x000001F561F31000-memory.dmp
memory/4968-104-0x000001F561F30000-0x000001F561F31000-memory.dmp