Analysis

  • max time kernel
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/05/2026, 16:48

General

  • Target
    ransomtest.exe
  • Size 73KB
  • Sample260527-vbge7sdt2j
  • SHA256 71c00fa8aaae931a771694a34aa72fe0fe0e324f0606266408b4cd6a1ba54842
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Renames multiple (250) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ransomtest.exe
    "C:\Users\Admin\AppData\Local\Temp\ransomtest.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:5296
  • C:\Users\Admin\AppData\Local\Temp\ransomtest.exe
    C:\Users\Admin\AppData\Local\Temp\ransomtest.exe
    1⤵
    • Adds Run key to start application
    PID:1472

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BlockConvertTo.7z.locked

        • Path C:\Users\Admin\Desktop\BlockConvertTo.7z.locked
        • Size 270KB
        • SHA256 f0112a7b67d3bd4294d8f8bb36522f7ff0828a5580d040ce430a4ede0d887951
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ClearMount.3gp2.locked

        • Path C:\Users\Admin\Desktop\ClearMount.3gp2.locked
        • Size 385KB
        • SHA256 ba8e1a344fb28ec3e81ae50b8b31bd422235fa660060d1689552fa34bd30234a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CloseWrite.ex_.locked

        • Path C:\Users\Admin\Desktop\CloseWrite.ex_.locked
        • Size 548KB
        • SHA256 8114860599b16def0c17b6b64378ccd235d81cfc82194d29c9a69c2d893da8ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CompareConnect.xltm.locked

        • Path C:\Users\Admin\Desktop\CompareConnect.xltm.locked
        • Size 499KB
        • SHA256 28232ca2eccd46894f19f5f35d81dfdf5461b8e7f42974f0c5f3f8cc1a928ef8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CompleteCopy.doc.locked

        • Path C:\Users\Admin\Desktop\CompleteCopy.doc.locked
        • Size 434KB
        • SHA256 12b6d2613058f4cec87ab375d2c8cb5bb19a26789d2368086424da37f8715251
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertToDismount.vsw.locked

        • Path C:\Users\Admin\Desktop\ConvertToDismount.vsw.locked
        • Size 581KB
        • SHA256 3ff11ee1fd80e3627dce672f63dc9361f324ff8345daedebe94dc2c538fba3b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertToInstall.cab.locked

        • Path C:\Users\Admin\Desktop\ConvertToInstall.cab.locked
        • Size 417KB
        • SHA256 8b87f8a469899c045d4fc25b860b41ade4f672c2b002c0bc4cd9f07564fa6144
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DenyRead.DVR-MS.locked

        • Path C:\Users\Admin\Desktop\DenyRead.DVR-MS.locked
        • Size 335KB
        • SHA256 69eda15a6d643a103da5912ea936dabb677bcb7c3ca15feda85e904a489dbc56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisconnectNew.pcx.locked

        • Path C:\Users\Admin\Desktop\DisconnectNew.pcx.locked
        • Size 319KB
        • SHA256 9f34f096068586619a03e46ee4dec69f599ffcd6885666faeb26dc5c3452910b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FormatImport.vsw.locked

        • Path C:\Users\Admin\Desktop\FormatImport.vsw.locked
        • Size 532KB
        • SHA256 c4b2dbd53376d94c11e7ab93080acee2d8ea9a7143a245dc836f772c14089ade
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GetApprove.i64.locked

        • Path C:\Users\Admin\Desktop\GetApprove.i64.locked
        • Size 401KB
        • SHA256 ef8ab3cbcc18519ed0966256e85d0812c442e225cdf732817ad30dedc73faf0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GroupUnblock.jpeg.locked

        • Path C:\Users\Admin\Desktop\GroupUnblock.jpeg.locked
        • Size 352KB
        • SHA256 8e9743778d5b91faedb3d57b7180a30f80b2112b179d9b1852dd9219648ba63f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ImportSend.vssm.locked

        • Path C:\Users\Admin\Desktop\ImportSend.vssm.locked
        • Size 303KB
        • SHA256 9b00309d804827658f3e42645b9d2f7e80eaed74053b2d23ca714d319caddd68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InitializeUnlock.mhtml.locked

        • Path C:\Users\Admin\Desktop\InitializeUnlock.mhtml.locked
        • Size 466KB
        • SHA256 1b3001d9ed8361c1353f1b890521988454787b18cf9323506fc69bbc1ed24a3b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft Edge.lnk.locked

        • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk.locked
        • Size 2KB
        • SHA256 0930bbf3e1e6dde95c7b643a069ea75e6d2dfc1aaab8993ce61307972e433273
        • MD5 SHA1 SHA512 TLSH

        MountCheckpoint.jpeg.locked

        • Path C:\Users\Admin\Desktop\MountCheckpoint.jpeg.locked
        • Size 565KB
        • SHA256 d90a00a7f8e2ea0689aa859b300bb749d568a76bf241a57a1ff149b4a68ed5a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MoveImport.temp.locked

        • Path C:\Users\Admin\Desktop\MoveImport.temp.locked
        • Size 237KB
        • SHA256 b17d9b5ae8d9ef8020a29eeb7c2b45fcfe6867d0e89bbdf40fe28068370e3a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenWrite.TTS.locked

        • Path C:\Users\Admin\Desktop\OpenWrite.TTS.locked
        • Size 204KB
        • SHA256 e686ba62563f3537669a3d4973de460f428f5dc5864385581defbd387250758f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ProtectUnlock.m1v.locked

        • Path C:\Users\Admin\Desktop\ProtectUnlock.m1v.locked
        • Size 516KB
        • SHA256 dd71c7f2748d7f09e513f6bfb76cdbf80dfcf986ccc4165aaa4a5365dfd27203
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RemoveOptimize.vsdm.locked

        • Path C:\Users\Admin\Desktop\RemoveOptimize.vsdm.locked
        • Size 483KB
        • SHA256 462a6aa70e7a84f372c8a43a28b561f890774826f5356fb2df0df03a50e6ab76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SetCopy.xps.locked

        • Path C:\Users\Admin\Desktop\SetCopy.xps.locked
        • Size 368KB
        • SHA256 b3ba7e6b9b3a492720ae73ab44c86d38c8982791088079b1cc8745791ff4117a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SplitComplete.jpe.locked

        • Path C:\Users\Admin\Desktop\SplitComplete.jpe.locked
        • Size 221KB
        • SHA256 e494c10ec12d3ae3383b03988bd970e178dcb883e734347e16ca56bf504aa20e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SuspendSave.kix.locked

        • Path C:\Users\Admin\Desktop\SuspendSave.kix.locked
        • Size 286KB
        • SHA256 698e20dd5436432cc326eb40db9f54416ca2ce63e317a561d723754cfcfd1db5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnpublishResume.mp3.locked

        • Path C:\Users\Admin\Desktop\UnpublishResume.mp3.locked
        • Size 802KB
        • SHA256 bc6b3dc65a5e9981d0d47cb813cc1e81edad6263033b517b84024581d097fe8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnpublishTest.bmp.locked

        • Path C:\Users\Admin\Desktop\UnpublishTest.bmp.locked
        • Size 253KB
        • SHA256 230860a0034a284f64d478943f67b74ed5ea59e3c2cf970d06a367f6ab815e4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnpublishWrite.ods.locked

        • Path C:\Users\Admin\Desktop\UnpublishWrite.ods.locked
        • Size 450KB
        • SHA256 0859924cac0a378d74ce784e1103b1849c8a7ef422b9446488b9e624c577492c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        desktop.ini.locked

        • Path C:\Users\Admin\Desktop\desktop.ini.locked
        • Size 282B
        • SHA256 3d4e272b781d959a70f3d2031fbf4709898e9c2e2019fd7185053c169ac55008
        • MD5 SHA1 SHA512 TLSH

        CompressReceive.vsdm.locked

        • Path C:\Users\Admin\Documents\CompressReceive.vsdm.locked
        • Size 1.3MB
        • SHA256 ab22001d52344be551cd0e51e33259b1b7a1bd14117f6eb1b6adf1a96c99cde6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CopyResolve.xlsx.locked

        • Path C:\Users\Admin\Documents\CopyResolve.xlsx.locked
        • Size 15KB
        • SHA256 a51d07453c95f4b193bdac881218d93612f4d02a4f1e6c1195e68fbb2c47c315
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GetImport.pptx.locked

        • Path C:\Users\Admin\Documents\GetImport.pptx.locked
        • Size 1.2MB
        • SHA256 f3c486f8c9213b8b96cbbd122477216fc55f46d3e75b58e0a037512448eb8833
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NewSend.pps.locked

        • Path C:\Users\Admin\Documents\NewSend.pps.locked
        • Size 614KB
        • SHA256 146554b32db9fce422cb781636ffba375f55b7b7520bc7ef43cd1c16e9f667ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Open Notebook.onetoc2.locked

        • Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.locked
        • Size 6KB
        • SHA256 036db0fe411d9e7042a59f6c98a621f27c808366e894071489d8185f9165defd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Quick Notes.one.locked

        • Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.locked
        • Size 351KB
        • SHA256 37b31ada64d54ac5e9de891a796f8c6424de88ae8b0447d893c67f1e089983ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Quick Notes.one.locked

        • Path C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.one.locked
        • Size 5KB
        • SHA256 64a7e5b24ae239de1583ee5eb7bf311ee4f38b328ee3c0d9471fe90ed04e280d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Outlook Data File - scxtrjqeou.pst.locked

        • Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - scxtrjqeou.pst.locked
        • Size 265KB
        • SHA256 9e71412336fcad58e5fe5121ea3ae9328b00837ab0d54adca8766a1ca5355898
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PingConnect.xlsb.locked

        • Path C:\Users\Admin\Documents\PingConnect.xlsb.locked
        • Size 1.1MB
        • SHA256 8d33620821422393076d8d57fd1f3121bcb45e2d72afaaf22cbe106272e4a378
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PopResume.odp.locked

        • Path C:\Users\Admin\Documents\PopResume.odp.locked
        • Size 2.3MB
        • SHA256 ba472d1c6f4415d7ab743771476c4959f0e8d058985d15f6e50b593319f59330
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RenameDisconnect.xlsx.locked

        • Path C:\Users\Admin\Documents\RenameDisconnect.xlsx.locked
        • Size 10KB
        • SHA256 defaa290a91930956a8d940cc8d5cd26c33fbec33b11aa0dd5b7b9e1edf6a6f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SearchEdit.vssx.locked

        • Path C:\Users\Admin\Documents\SearchEdit.vssx.locked
        • Size 737KB
        • SHA256 23915ff2ef988eb73a22f75ad7489d49a142960a05f4a64d97fa5fb2170c25a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnblockPing.xlsx.locked

        • Path C:\Users\Admin\Documents\UnblockPing.xlsx.locked
        • Size 860KB
        • SHA256 4241fc911c6cd9dc00d2ae7bbb0b2035ec3b6ac7e671350d779cf4058adeab7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UndoWait.pot.locked

        • Path C:\Users\Admin\Documents\UndoWait.pot.locked
        • Size 1.4MB
        • SHA256 1c8f63b5ae806c26c2c57c81e3b2b4f671d03927175072c97c9bea0cb5b08533
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UninstallInstall.xlsx.locked

        • Path C:\Users\Admin\Documents\UninstallInstall.xlsx.locked
        • Size 11KB
        • SHA256 48c27d4fa1122347b6b89f40eb3f18d4a5075a910a36612b4f679e561fae8787
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WaitClose.vsx.locked

        • Path C:\Users\Admin\Documents\WaitClose.vsx.locked
        • Size 1.6MB
        • SHA256 e7776de50eb008f885b331f2641fdf1efdfb3519996aec233796031710b8b741
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WaitGrant.pptx.locked

        • Path C:\Users\Admin\Documents\WaitGrant.pptx.locked
        • Size 983KB
        • SHA256 a83ab2a14199f01fa1afbe7dba31ca3b290b930c6b0f556c317c8be163ef5ab9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        desktop.ini.locked

        • Path C:\Users\Admin\Documents\desktop.ini.locked
        • Size 402B
        • SHA256 b610f85ec58e3140c012559673c8016112553507e68f6774db0fa7200d6b0459
        • MD5 SHA1 SHA512 TLSH

        ApproveGrant.eps.locked

        • Path C:\Users\Admin\Pictures\ApproveGrant.eps.locked
        • Size 136KB
        • SHA256 33d802e86fdf2da966b5707a35ec1dcff14fba7369c53d3bd9e2c4a0142b78a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BackupClose.pcx.locked

        • Path C:\Users\Admin\Pictures\BackupClose.pcx.locked
        • Size 204KB
        • SHA256 7f5225abf7e619564dc07845c7231e874df5990ec74f25a3eb44a82b72f43a5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BlockGrant.pcx.locked

        • Path C:\Users\Admin\Pictures\BlockGrant.pcx.locked
        • Size 174KB
        • SHA256 5d9030cd7d1e36f7c2deab7c1d1b53cce9df8f7036d32dce0e1e2f593d00e8ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BlockSelect.emz.locked

        • Path C:\Users\Admin\Pictures\BlockSelect.emz.locked
        • Size 153KB
        • SHA256 b2ad9743aa5bbb5dd8e3b54355a75db86a132c38ad106c3cd9a1d1aa5ebf6723
        • MD5 SHA1 SHA512 SSDEEP TLSH

        desktop.ini.locked

        • Path C:\Users\Admin\Pictures\Camera Roll\desktop.ini.locked
        • Size 190B
        • SHA256 09f6e0c392a8793d06869e184acd4b0b9a18b01152dbd3a995658294239f9165
        • MD5 SHA1 SHA512 TLSH

        CheckpointWait.dib.locked

        • Path C:\Users\Admin\Pictures\CheckpointWait.dib.locked
        • Size 161KB
        • SHA256 c04c2eda120dcb83d8268df72e49d58b7a3460f52a7198daa1cabe9b36f3d370
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CompressSave.jpeg.locked

        • Path C:\Users\Admin\Pictures\CompressSave.jpeg.locked
        • Size 106KB
        • SHA256 b164dab767a939c59cb053b2b57d54932a5d4ad57dd565089ad33dd54e5da7ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConfirmFind.eps.locked

        • Path C:\Users\Admin\Pictures\ConfirmFind.eps.locked
        • Size 85KB
        • SHA256 66fac185e3429b5f5396a8469ff5c51087c374addb86e6f04fd248e16a69feee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConfirmResize.dxf.locked

        • Path C:\Users\Admin\Pictures\ConfirmResize.dxf.locked
        • Size 148KB
        • SHA256 72e0b189766cd84d963a853edccf121026be53726bac6d2c4265b969d7c4449c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpandInvoke.svg.locked

        • Path C:\Users\Admin\Pictures\ExpandInvoke.svg.locked
        • Size 93KB
        • SHA256 f727c37af422c33fd1c99e4597ffeed414cbe41c93bf082a35c21523644053ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpandUnpublish.dib.locked

        • Path C:\Users\Admin\Pictures\ExpandUnpublish.dib.locked
        • Size 131KB
        • SHA256 a2c1129a322e06aefa509fb26304db04b4b8dfcb593d83a242e63ce1916a4fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpandWatch.png.locked

        • Path C:\Users\Admin\Pictures\ExpandWatch.png.locked
        • Size 80KB
        • SHA256 d39a41d8609c3d8ee1319facc9c17145835ecfe9ee538fca0909e9f7660c267b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GetSet.emf.locked

        • Path C:\Users\Admin\Pictures\GetSet.emf.locked
        • Size 114KB
        • SHA256 b5cb2c4c3292f30042a2cab97329e9756510513b25cf74fe0a14d75f3fbbb31f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ImportExit.eps.locked

        • Path C:\Users\Admin\Pictures\ImportExit.eps.locked
        • Size 165KB
        • SHA256 2e5d7a2b455ef07c1e2839e09e1cd5f8cc8e24d0c52c083ad4bf32cd1655b3b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MeasureAdd.tif.locked

        • Path C:\Users\Admin\Pictures\MeasureAdd.tif.locked
        • Size 127KB
        • SHA256 897c3b99e5698fabd15d9b32c5ef6bcd753e24aeaf27999621ecc3f3dc1c1369
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MoveMount.png.locked

        • Path C:\Users\Admin\Pictures\MoveMount.png.locked
        • Size 123KB
        • SHA256 66a74b3774a43e0bb9bbc8ee6cfd6eefb04ea04f24bfb804332a5fbb5b90096c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenShow.crw.locked

        • Path C:\Users\Admin\Pictures\OpenShow.crw.locked
        • Size 119KB
        • SHA256 c0afe9b70ba84035913fd85ba69b3d6a399e778040310161ab545970a0818b9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenStep.gif.locked

        • Path C:\Users\Admin\Pictures\OpenStep.gif.locked
        • Size 144KB
        • SHA256 7988e86c442d49a4adc5e6d27df9f1e440ba9af2bafaa13814b4a0774c10015f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        desktop.ini.locked

        • Path C:\Users\Admin\Pictures\desktop.ini.locked
        • Size 504B
        • SHA256 92809dab812e58112411db8d0962f0ff59d777b3a1181ba2a9c328c89f1d043c
        • MD5 SHA1 SHA512 TLSH