af0d0568f070ecf90825528497c1524bc2ed3c5d06e42580d7b51382238b9a25

Analysis

user interaction
yes
max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fr-decrypter.exe
Size 14KB
Sample260508-vgrs5aex2n
SHA256 af0d0568f070ecf90825528497c1524bc2ed3c5d06e42580d7b51382238b9a25
MD5 d6ba7ff81c04b67eb4a370698db53e1e
SHA1 d49ff7cf216c9da852e2334efbb598ba88131b9b
SHA512 f440a53fd1f85e2791e899add71d0cea477e9b424f4072c385a218b2893561017a17e99d9441bef79e58b16588294177058cc9ff9100a37b125e5326387674f2
SSDEEP 384:p0zFOIMfPaBJQsJpMOBJSyP4CGNn01jJY2:epOI5vgdQmN8u2
TLSH
T18F521A157FFA8059F17F8F345AF15292D67AF2622A07E70F08C4124A0F63B84DBA2675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Web\\Wallpaper\\Windows\\img0.jpg"	fr-decrypter.exe

C:\Users\Admin\AppData\Local\Temp\fr-decrypter.exe
"C:\Users\Admin\AppData\Local\Temp\fr-decrypter.exe"
1⤵
- Sets desktop wallpaper using registry
PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-0-0x0000000000A70000-0x0000000000A7A000-memory.dmp

Download

memory/2748-1-0x0000000001280000-0x0000000001290000-memory.dmp