Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/06/2026, 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ransomware_clr_unhook_fixed.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
ransomware_clr_unhook_fixed.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target ransomware_clr_unhook_fixed.exe
- Size 949KB
- Sample260620-btnsfsdy8s
- SHA256 e4b6294b3edb902c667da70c0144381bd4850c0fee8bda1c211ceb87bed64bad
- MD5 8b3b66c1717ca521a86b18e7055b4506
- SHA1 529f9a7f2042748d1b188414a0b6eb4a8e89f17e
- SHA512 7bf5c3fef31fa05d547597b5648f8311b1a71eb88a36a881083b509cf134c7da5a000b4026f8cd0e2dcecdda64fef813752c4e0baa83c39c7d0eb61865734db2
- SSDEEP 12288:Jo6RHFgfvYOLQlmGw1HnDXY/repKW4QsBZ8KMjBmDJBX:JvRHSvNLQlmGw1HDXY/rP3Mj6B
- TLSH T1E2252B1BE2A345E8C52FD0748796D772BE70B86A01347D6F1DA4E7321F20E609F5AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions ransomware_clr_unhook_fixed.exe - Renames multiple (14526) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools ransomware_clr_unhook_fixed.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\System32\\svchost.exe" ransomware_clr_unhook_fixed.exe - Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Public\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Music\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-537605601-1362463912-856654178-1000\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Links\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Public\Desktop\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Public\Videos\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-537605601-1362463912-856654178-1000\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Public\Libraries\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Public\Documents\desktop.ini ransomware_clr_unhook_fixed.exe File opened for modification C:\Users\Public\Music\desktop.ini ransomware_clr_unhook_fixed.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Control Panel\Desktop\Wallpaper ransomware_clr_unhook_fixed.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Http.Json.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\dt.jar ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\da.pak.encrypted ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ui-strings.js ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\msdaorar.dll.mui ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_bho_64.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\en-GB.pak.DATA ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\el_NEUTER.pak ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-file-l2-1-0.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\es-ES\msadcor.dll.mui ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\msedge_200_percent.pak.DATA ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.encrypted ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-focus.svg ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\Mu\TransparentAdvertisers.DATA ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af_MASCULINE.pak.encrypted ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_FEMININE.pak.encrypted ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Mozilla Firefox\mozwer.dll.encrypted ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\ui-strings.js ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\ui-strings.js ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\vk_swiftshader.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\te.pak ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\mip_core.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\tipresx.dll.mui ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Common Files\System\msadc\msaddsr.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAMEEXT.DLL ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\delegatedWebFeatures.sccd ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\ui-strings.js ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\or-IN\tipresx.dll.mui ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\UIAutomationClient.resources.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\MSADDNDR.OLB ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\PNG32.FLT ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\DirectInk.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll ransomware_clr_unhook_fixed.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.encrypted ransomware_clr_unhook_fixed.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Control Panel\Desktop\WallpaperStyle = "0" ransomware_clr_unhook_fixed.exe Set value (str) \REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Control Panel\Colors\Background = "255 0 0" ransomware_clr_unhook_fixed.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2772 ransomware_clr_unhook_fixed.exe 2772 ransomware_clr_unhook_fixed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransomware_clr_unhook_fixed.exe"C:\Users\Admin\AppData\Local\Temp\ransomware_clr_unhook_fixed.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
PID:2772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe1⤵PID:3928
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-537605601-1362463912-856654178-1000\desktop.ini
- Size 129B
- SHA256 0251cc177d19895a1b8f41af5e595debd7660feed6a0be5a5b71a5fa36f98ef7
- MD5 51133304212ad04a257da274e9b297ba
- SHA1 e6bf93f3c5ecd3fe641da2db99b1c892bd10fd46
- SHA512 a26e0db9896bb33ba682f45fe6ad0702fbf8e72b586c4f929d3ee81f56f64b580c64e3232f636d8323ecad6a6148c9cad00ea4317d6103606c7cf5aa328b8888
- TLSH T1C1B02BC4F24840D1208F1C834043E831584031193999940F14F2C57311000112D436C3
- MD5 SHA1 SHA512 TLSH