37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe
Size 59KB
Sample260529-ar2e4aey2k
SHA256 37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d
MD5 74ee035b20a8cf19ef36b01071e5147b
SHA1 e132f6564aa631608fe7436e035a0a177e8bdf8a
SHA512 b188f74d040cf60289220c942beb08b9d6bf9a0f87d33d3e29c5ee771a38ec605158485566a0d207fcd49ec89e3287e03950236fba7bc6fbb53d45c62f21dfd5
SSDEEP 1536:Fai2SnTCAB8hs2Ds8lFJH/N1RekrCJLPmmVzd:FT1nTC08hs2AaFJfTRdrCxB
TLSH
T1A8535B4BE36400F4E1B3863089E79A16BA33F846C735524F46A495AA1F733D1EE38779
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3520	timeout.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	1380	vssvc.exe
Token: SeRestorePrivilege	1380	vssvc.exe
Token: SeAuditPrivilege	1380	vssvc.exe
Token: SeDebugPrivilege	5096	37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1380	5096	37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe	83
PID 5096 wrote to memory of 3568	5096	37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe	84
PID 3568 wrote to memory of 3520	3568	cmd.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe
"C:\Users\Admin\AppData\Local\Temp\37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:3520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-0-0x0000025311610000-0x0000025311611000-memory.dmp

Download