Analysis
- user interaction
yes - max time kernel
152s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
27/04/2026, 01:43
General
- Target vile.exe
- Size 8.7MB
- Sample260427-b5fafsa181
- SHA256 f376376336cdeb0dbd1bdd3e9684a837f907ec863d2a859097e46d4a5e6f1f42
Malware Config
Extracted
-
C:\Users\Admin\Desktop\VILE_README.txt
- ===================================================================== YOUR FILES HAVE BEEN ENCRYPTED ===================================================================== Oooops! your computer is now under the control of the vile collective. All data has been encrypted using an unbreakable offshore servers, your files are permanently inaccessible. ===================================================================== ENCRYPTION SUMMARY ===================================================================== File encrypted: 1523 Total size: 308.27 MB Victim ID: b00acdac030aea7fc3884bd9fa28d651 Time: 2026-04-27 02:43:36 ===================================================================== WHAT HAPPENED? ===================================================================== All your files are have been encrypted with military-grade encryption. The encryption key has been sent to our secure server. Without it, your files cannot be recovered. Backups have been destroyed. Recovery tools have been disabled. ===================================================================== HOW TO RECOVER YOUR FILES ===================================================================== 1. Contact us using the information below 2. Provide your Victim ID 3. Wait for further instructions ===================================================================== PAYMENT ===================================================================== Amount: $1,500 USD BTC: bc1q9mgz97m0j4vtutjqq966vmj785tsr38nvafwxm XMR: 4AQ9VGowYXNdowUeSCGFLFV7inyRuRRfxBQQSDurBsSi8j7FJNANJY917P1CmvE8cFbVJ5Gx99rYX7SoSjDQkzbH34P8Xf4 ===================================================================== DEADLINE ===================================================================== Public data publication will happen after 14 days ===================================================================== CONTACT ===================================================================== ===================================================================== WARNINGS ===================================================================== DO NOT: Attempt to decrypt files yourself Rename or modify encrypted files Use third-party recovery tools Run system restore Reinstall Windows Any attempt to modify, recover, or remove this application will result in the PERMANENT DESTRUCTION of your decryption key If you do not cooperate before the deadline, your files will remain locked and your private data will be published for everyone to see. Do not turn off, restart, or unplug this computer — doing so may permanently damage your files. If you attempt to power down, the decryption key will be destroyed. =====================================================================
Extracted
-
C:\Users\Admin\Desktop\VILE_README.txt
- ===================================================================== YOUR FILES HAVE BEEN ENCRYPTED ===================================================================== Oooops! your computer is now under the control of the vile collective. All data has been encrypted using an unbreakable offshore servers, your files are permanently inaccessible. ===================================================================== ENCRYPTION SUMMARY ===================================================================== File encrypted: 6 Total size: 1.01 MB Victim ID: d1b0d669f1cb6153189d76b3cabac331 Time: 2026-04-27 02:44:17 ===================================================================== WHAT HAPPENED? ===================================================================== All your files are have been encrypted with military-grade encryption. The encryption key has been sent to our secure server. Without it, your files cannot be recovered. Backups have been destroyed. Recovery tools have been disabled. ===================================================================== HOW TO RECOVER YOUR FILES ===================================================================== 1. Contact us using the information below 2. Provide your Victim ID 3. Wait for further instructions ===================================================================== PAYMENT ===================================================================== Amount: $1,500 USD BTC: bc1q9mgz97m0j4vtutjqq966vmj785tsr38nvafwxm XMR: 4AQ9VGowYXNdowUeSCGFLFV7inyRuRRfxBQQSDurBsSi8j7FJNANJY917P1CmvE8cFbVJ5Gx99rYX7SoSjDQkzbH34P8Xf4 ===================================================================== DEADLINE ===================================================================== Public data publication will happen after 14 days ===================================================================== CONTACT ===================================================================== ===================================================================== WARNINGS ===================================================================== DO NOT: Attempt to decrypt files yourself Rename or modify encrypted files Use third-party recovery tools Run system restore Reinstall Windows Any attempt to modify, recover, or remove this application will result in the PERMANENT DESTRUCTION of your decryption key If you do not cooperate before the deadline, your files will remain locked and your private data will be published for everyone to see. Do not turn off, restart, or unplug this computer — doing so may permanently damage your files. If you attempt to power down, the decryption key will be destroyed. =====================================================================
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Sets desktop wallpaper using registry 2 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Modifies registry class 1 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\vile.exe"C:\Users\Admin\AppData\Local\Temp\vile.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command " $ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut('C:\Users\Admin\Desktop\vile_Decryptor.lnk') $s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\vile.exe' $s.IconLocation = 'C:\Users\Admin\AppData\Local\Temp\vile_icon.ico' $s.Save() "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\vile.exe"C:\Users\Admin\AppData\Local\Temp\vile.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command " $ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut('C:\Users\Admin\Desktop\vile_Decryptor.lnk') $s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\vile.exe' $s.IconLocation = 'C:\Users\Admin\AppData\Local\Temp\vile_icon.ico' $s.Save() "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\VILE_README.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\vile.exe"C:\Users\Admin\AppData\Local\Temp\vile.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command " $ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut('C:\Users\Admin\Desktop\vile_Decryptor.lnk') $s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\vile.exe' $s.IconLocation = 'C:\Users\Admin\AppData\Local\Temp\vile_icon.ico' $s.Save() "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
powershell.exe.log.vile
powershell.exe.log.vile
KnownGameList.bin.vile
KnownGameList.bin.vile
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
start.bin.vile
TileCache_100_4_PNGEncoded_Data.bin.vile
TileCache_100_4_PNGEncoded_Data.bin.vile
TileCache_100_4_PNGEncoded_Header.bin.vile
TileCache_100_4_PNGEncoded_Header.bin.vile
settings.dat.vile
SearchHoverUnifiedTileModelCache.dat
SettingsCache.txt
SettingsCache.txt.vile
__PSScriptPolicyTest_5xbjsbai.xio.ps1
vile_icon.ico
VILE_README.txt
VILE_README.txt
VILE_README.txt.vile
vile_Decryptor.lnk
vile_Decryptor.lnk
vile_Decryptor.lnk.vile
memory/396-1581-0x000001A2F87A0000-0x000001A2F87AC000-memory.dmp
memory/396-1584-0x000001A2FA3C0000-0x000001A2FA3D2000-memory.dmp
memory/396-1583-0x000001A2FA6F0000-0x000001A2FA7DA000-memory.dmp
memory/396-1582-0x000001A2F87D0000-0x000001A2F87D8000-memory.dmp
memory/848-1544-0x00000267662E0000-0x00000267663CA000-memory.dmp
memory/848-1551-0x00000267643E0000-0x00000267643EC000-memory.dmp
memory/848-1543-0x00000267643E0000-0x00000267643EC000-memory.dmp
memory/848-1552-0x00000267662E0000-0x00000267663CA000-memory.dmp
memory/1056-1667-0x000001ED56200000-0x000001ED562EA000-memory.dmp
memory/1056-1603-0x000001ED56200000-0x000001ED562EA000-memory.dmp
memory/1056-1651-0x000001ED56200000-0x000001ED562EA000-memory.dmp
memory/1740-1585-0x0000018C747D0000-0x0000018C747DC000-memory.dmp
memory/1740-1586-0x0000018C76740000-0x0000018C7682A000-memory.dmp
memory/2284-1588-0x0000020B4F9E0000-0x0000020B4FACA000-memory.dmp
memory/2284-1589-0x0000020B4F9E0000-0x0000020B4FACA000-memory.dmp
memory/2600-1666-0x0000026089D20000-0x0000026089D28000-memory.dmp
memory/2600-1664-0x00000260A2220000-0x00000260A230A000-memory.dmp
memory/2600-1663-0x0000026088310000-0x000002608831C000-memory.dmp
memory/2600-1665-0x0000026089CA0000-0x0000026089CB2000-memory.dmp
memory/2860-1602-0x000001FD57D00000-0x000001FD57DEA000-memory.dmp
memory/4348-1541-0x00000208CBDB0000-0x00000208CBDB8000-memory.dmp
memory/4348-1527-0x00000208CBE40000-0x00000208CBE50000-memory.dmp
memory/4348-1526-0x00000208CBE40000-0x00000208CBE50000-memory.dmp
memory/4348-1534-0x00000208E45A0000-0x00000208E45C2000-memory.dmp
memory/4348-1535-0x00000208CBE40000-0x00000208CBE50000-memory.dmp
memory/4348-1539-0x00000208CA540000-0x00000208CA54C000-memory.dmp
memory/4348-1542-0x00000208CBE50000-0x00000208CBE62000-memory.dmp
memory/4348-1540-0x00000208E4440000-0x00000208E452A000-memory.dmp
memory/4448-1650-0x000001EC45040000-0x000001EC4504C000-memory.dmp
memory/4448-1669-0x000001EC47000000-0x000001EC470EA000-memory.dmp
memory/4448-1671-0x000001EC45040000-0x000001EC4504C000-memory.dmp
memory/4448-1672-0x000001EC47000000-0x000001EC470EA000-memory.dmp