11bbb3a4b3122d2a9d97532db9e412fe5d70ab7ff25bb1613eccd2052cce8543

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ratonClientttest.exe
Size 94KB
Sample260429-wq897set2t
SHA256 11bbb3a4b3122d2a9d97532db9e412fe5d70ab7ff25bb1613eccd2052cce8543
MD5 cc9dc4ac82666442f655820bcb1106a2
SHA1 ba4a11a17cfb79e0e1a35d4c96f2abad7477715c
SHA512 5adf7e2d5980507d882187db8ffd20ca2aee50317e7763897741b7c0e67b888c6d86883c67f05d2022c70c0db5cc8376759af508be0aa0b73b1c060912ebc3c2
SSDEEP 1536:SagVZgr9rGdTsqa4tsi5EtnTqvTxnOW8g20Sb/Kp+CKC8Ov1h:fgVKr9eAX4tnG4L9OWT20Sb/KzKCfvb
TLSH
T1FA934A0033FC2926E3FF8FBE69B520510F76B9579E31D64D498A60980A71B869D20F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3980	powershell.exe
3980	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2580	ratonClientttest.exe
5092	ratonClientttest.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\wallpaper.jpg"	ratonClientttest.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3940	timeout.exe
5032	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3980	powershell.exe
3980	powershell.exe
2580	ratonClientttest.exe
2580	ratonClientttest.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	ratonClientttest.exe
Token: SeDebugPrivilege	2580	ratonClientttest.exe
Token: SeDebugPrivilege	3980	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 5068	5804	ratonClientttest.exe	86
PID 5068 wrote to memory of 4960	5068	cmd.exe	88
PID 5068 wrote to memory of 5032	5068	cmd.exe	89
PID 5068 wrote to memory of 2580	5068	cmd.exe	90
PID 5068 wrote to memory of 3940	5068	cmd.exe	91
PID 2580 wrote to memory of 5404	2580	ratonClientttest.exe	92
PID 2580 wrote to memory of 3980	2580	ratonClientttest.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ratonClientttest.exe
"C:\Users\Admin\AppData\Local\Temp\ratonClientttest.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_DNXXmzgGYwmnA9AZlHV4iNEZIVlug6.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4960
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5032
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe"
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "ratonClientttest" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3980
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3940

C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe"
1⤵
- Executes dropped EXE
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

ratonClientttest.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ratonClientttest.exe.log
Size 859B
SHA256 685f70bf685f654651dcd0acc495b6f52f02f73cc3ca8b3d2c8433aac9ba144d
MD5 e204f3d12abd1691ce1f149399441188
SHA1 798042095539abfe857e456fca4e1035f67d29bf
SHA512 804c5ea57a59f86fd0c34479be4c479230bff79093548e8461758829928969da565c211ccc9cb9befa0fef15f0400a5b1f17d5ddf88aef6ff01b67a191176b9f
TLSH
T1E7116B70227AA1D889162F952C1E2BC403BF4336B650DE0C7998729EED364175F212E7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1pcqxdqn.52v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1pcqxdqn.52v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ratonClientttest.exe

Path C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe
Size 94KB
SHA256 11bbb3a4b3122d2a9d97532db9e412fe5d70ab7ff25bb1613eccd2052cce8543
MD5 cc9dc4ac82666442f655820bcb1106a2
SHA1 ba4a11a17cfb79e0e1a35d4c96f2abad7477715c
SHA512 5adf7e2d5980507d882187db8ffd20ca2aee50317e7763897741b7c0e67b888c6d86883c67f05d2022c70c0db5cc8376759af508be0aa0b73b1c060912ebc3c2
SSDEEP 1536:SagVZgr9rGdTsqa4tsi5EtnTqvTxnOW8g20Sb/Kp+CKC8Ov1h:fgVKr9eAX4tnG4L9OWT20Sb/KzKCfvb
TLSH
T1FA934A0033FC2926E3FF8FBE69B520510F76B9579E31D64D498A60980A71B869D20F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_DNXXmzgGYwmnA9AZlHV4iNEZIVlug6.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_DNXXmzgGYwmnA9AZlHV4iNEZIVlug6.bat
Size 566B
SHA256 5defffa00fa20a2a040d9743257da73e22d31cc789151a6353c0dd38c9c1fe6a
MD5 925320116c98dd9b64f13490c6234eec
SHA1 195dd95663f2f5ec80e2afb549457900cb4751f1
SHA512 3b6756a97436dfe76247c60de8a7f27be35508d1446e0140515c953b157545f1e48e1302ea0ae3daceb736244e4d1beb358502af4d98b3a8d5a39a93d7b08cfc
TLSH
T165F04691B38A57280000913B0EB77289D2AA841ABF8135823A18C04E1B9A00FE7C7BE1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2580-13-0x000002C79C940000-0x000002C79C950000-memory.dmp

Download

memory/2580-15-0x000002C79C930000-0x000002C79C93C000-memory.dmp

Download

memory/2580-16-0x000002C79C940000-0x000002C79C950000-memory.dmp

Download

memory/2580-18-0x000002C79CCF0000-0x000002C79D066000-memory.dmp

Download

memory/2580-37-0x000002C79D1F0000-0x000002C79D202000-memory.dmp

Download

memory/2580-38-0x000002C79D1B0000-0x000002C79D1BA000-memory.dmp

Download

memory/3980-26-0x00000231DB060000-0x00000231DB082000-memory.dmp

Download

memory/3980-29-0x00000231D91A0000-0x00000231D91AC000-memory.dmp

Download

memory/5804-2-0x000002013C160000-0x000002013C168000-memory.dmp

Download

memory/5804-0-0x000002013BDA0000-0x000002013BDBE000-memory.dmp

Download

memory/5804-1-0x0000020156460000-0x0000020156470000-memory.dmp

Download