Analysis
- user interaction
yes - max time kernel
453s - max time network
450s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 22:15
General
- Target alpushka-ransomlab.exe
- Size 1.2MB
- Sample260620-159lqsaz21
- SHA256 e1745a9a67903c13fce7b39090039ca538aefcf8d801d0e7fbfff545156c135a
Malware Config
Signatures
- Renames multiple (747) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\alpushka-ransomlab.exe"C:\Users\Admin\AppData\Local\Temp\alpushka-ransomlab.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\README.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Users\Admin\Desktop\alpushka-ransomlab.exe"C:\Users\Admin\Desktop\alpushka-ransomlab.exe"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ReceiveUninstall.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\Desktop\alpushka-ransomlab.exe"C:\Users\Admin\Desktop\alpushka-ransomlab.exe"1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README (2).txt1⤵
- Modifies registry class
-
C:\Program Files (x86)\alpushka-ransomlab.exe"C:\Program Files (x86)\alpushka-ransomlab.exe"1⤵
- Drops file in Program Files directory
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"1⤵
-
C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"1⤵
-
C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"1⤵
-
C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"1⤵
-
C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"1⤵
-
C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"1⤵
-
C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"C:\Program Files (x86)\Windows Defender\alpushka-ransomlab.exe"1⤵
-
C:\Program Files (x86)\Internet Explorer\alpushka-ransomlab.exe"C:\Program Files (x86)\Internet Explorer\alpushka-ransomlab.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
README.txt
AddPublish.pptx.alpushka
ApproveBackup.tif.alpushka
DisableUpdate.bmp.alpushka
EnableApprove.pdf.alpushka
GetEnter.docx.alpushka
README.txt
ReceiveUninstall.xlsx
ResumeRead.bmp.alpushka
SendUnlock.docx.alpushka
SuspendEnable.iso.alpushka
WriteClear.xlsb.alpushka
memory/828-3112-0x00007FF61E7C0000-0x00007FF61E8A3000-memory.dmp
memory/1388-3119-0x00007FF75EF30000-0x00007FF75F013000-memory.dmp
memory/1440-3113-0x00007FF61E7C0000-0x00007FF61E8A3000-memory.dmp
memory/2128-104-0x00007FFEFC6E0000-0x00007FFEFC6F0000-memory.dmp
memory/2128-128-0x00007FFEFC6E0000-0x00007FFEFC6F0000-memory.dmp
memory/2128-109-0x00007FFEF99B0000-0x00007FFEF99C0000-memory.dmp
memory/2128-129-0x00007FFEFC6E0000-0x00007FFEFC6F0000-memory.dmp
memory/2128-130-0x00007FFEFC6E0000-0x00007FFEFC6F0000-memory.dmp
memory/2128-105-0x00007FFEFC6E0000-0x00007FFEFC6F0000-memory.dmp
memory/2128-107-0x00007FFEFC6E0000-0x00007FFEFC6F0000-memory.dmp
memory/2128-108-0x00007FFEFC6E0000-0x00007FFEFC6F0000-memory.dmp
memory/2128-106-0x00007FFEFC6E0000-0x00007FFEFC6F0000-memory.dmp
memory/2128-110-0x00007FFEF99B0000-0x00007FFEF99C0000-memory.dmp
memory/2128-127-0x00007FFEFC6E0000-0x00007FFEFC6F0000-memory.dmp
memory/2480-3118-0x00007FF61E7C0000-0x00007FF61E8A3000-memory.dmp
memory/2888-103-0x00007FF734290000-0x00007FF734373000-memory.dmp
memory/3044-3117-0x00007FF61E7C0000-0x00007FF61E8A3000-memory.dmp
memory/3548-146-0x00007FF734290000-0x00007FF734373000-memory.dmp
memory/3836-3115-0x00007FF61E7C0000-0x00007FF61E8A3000-memory.dmp
memory/4224-3116-0x00007FF61E7C0000-0x00007FF61E8A3000-memory.dmp
memory/5016-3114-0x00007FF61E7C0000-0x00007FF61E8A3000-memory.dmp
memory/5232-80-0x00007FF734290000-0x00007FF734373000-memory.dmp
memory/5340-3109-0x00007FF61E7C0000-0x00007FF61E8A3000-memory.dmp