Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
20/05/2026, 03:12
General
- Target c7cf556fed330b8fbef1f25bdb6aec0007b42a042abfb4f82ba52e20754d0ee3.exe
- Size 431KB
- Sample260520-dqa4asas3m
- SHA256 c7cf556fed330b8fbef1f25bdb6aec0007b42a042abfb4f82ba52e20754d0ee3
Malware Config
Extracted
-
C:\Users\Admin\Desktop\Important.txt
- DEAR USER.. This is the developer of DarkWorld File Crypter tool, you have been running our tool in your system which caused your files to get encrypted. Don't worry, you can return all your files! All your files like pictures, databases, documents and other important files that were encrypted with strongest encryption and unique key. The only method of recovering files is to purchase the Decryption tool from me. the decryption tool will not be able to decrypt your files if the encrypted files were encrypted after 72 hours , which means you need to contact us before 72hours from decryption so we can help you solve your problem. Please note that you'll never restore your data without payment. Price of private key and decrypt software is $300. To Buy the decryption tool you must follow the following steps : 1 - Send the equivalent of 300$ in bitcoins to this wallet : 1EdxGR5fxRjhWtxNSbyDHv4nVdx5BP54L2 ----------------------------------------------------- * What is bitcoin ? : https://www.investopedia.com/terms/b/bitcoin.asp * How to buy Bitcoin ? : https://www.investopedia.com/articles/investing/082914/basics-buying-and-investing-bitcoin.asp * Where to buy Bitcoin ? : https://www.blockchain.com/ https://coinbase.com/ https://robinhood.com/ https://www.coinmama.com ----------------------------------------------------- 2 - Once your payment is done copy your personal ID and send it to me in this email : << [email protected] >>. ----------------------------------------------------- 3 - After i confirm the payment is received you will immediatly receive the decryption tool and the decryption key of your files , and also you will receive a full guide and a video explaining how to use the decryption tool to decrypt all your files . ----------------------------------------------------- 4 - in case of trust issues you can send one of your encrypted files to my email and i will decrypt it and send it back to you as a valid proof of the decryption tool. Your personal ID : 60114754
-
1EdxGR5fxRjhWtxNSbyDHv4nVdx5BP54L2
-
https://www.investopedia.com/terms/b/bitcoin.asp
-
https://www.investopedia.com/articles/investing/082914/basics-buying-and-investing-bitcoin.asp
-
https://www.blockchain.com/
-
https://coinbase.com/
-
https://robinhood.com/
-
https://www.coinmama.com
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7cf556fed330b8fbef1f25bdb6aec0007b42a042abfb4f82ba52e20754d0ee3.exe"C:\Users\Admin\AppData\Local\Temp\c7cf556fed330b8fbef1f25bdb6aec0007b42a042abfb4f82ba52e20754d0ee3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Important.txt
Important.txt.dark
memory/6020-5-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-11-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-4-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-0-0x00007FFC48855000-0x00007FFC48856000-memory.dmp
memory/6020-6-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-7-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-8-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-9-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-10-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-3-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-12-0x000000001D970000-0x000000001DA16000-memory.dmp
memory/6020-15-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-2-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-1-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-87-0x00007FFC48855000-0x00007FFC48856000-memory.dmp
memory/6020-88-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-89-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-90-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp
memory/6020-91-0x00007FFC485A0000-0x00007FFC48F41000-memory.dmp