Analysis
- user interaction
yes - max time kernel
52s - max time network
33s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/06/2026, 01:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ransom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
ransom.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target ransom.exe
- Size 952KB
- Sample260620-bzbebady9t
- SHA256 1e201b302e3020259d91a23abf8ddad08d2ae188cf565783f8d242e66e95b6ed
- MD5 e6eacd4edb47efd89e9d89ee997b9a8c
- SHA1 b4f35a4b0a25b0eedc32a0bb749e3e5fe680ac39
- SHA512 264327da7b709c48ae315355fc596bfc11c43a785227f3fec63f5c0393e8b40c5a24edec9250ea5de2077e806de0d5625dbc6ca3fa6b3488cfdfd96264b433ac
- SSDEEP 12288:ilJUx6gwP5KnKjMEQHzz6dycFD9/5dW1c4C2ByAGmm4M:ijUxChKnKjMEQHX6dycyByA+5
- TLSH T11A252B1BE2A345ECC52BD07487629772BE70B46A01347E6F1EE4D7321F21E609F5AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions ransom.exe - Renames multiple (10431) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools ransom.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\System32\\svchost.exe" ransom.exe - Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-487906980-2895880840-1957110281-1000\desktop.ini ransom.exe File opened for modification C:\Program Files\desktop.ini ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI ransom.exe File opened for modification C:\Program Files (x86)\desktop.ini ransom.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinGrid.v8.1.dll ransom.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\xmlrw_xl.dll ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d ransom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mt-MT\tipresx.dll.mui ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms ransom.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\ui-strings.js ransom.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado21.tlb ransom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\win11\identity_helper.Sparse.Internal.msix ransom.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOIDCLIL.DLL ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\VVIEWRES.DLL ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle_2x.png ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\close.svg ransom.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sl_NEUTER.pak ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms ransom.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui ransom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Locales\es-419.pak ransom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\oneauth.dll ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\ui-strings.js ransom.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons.png ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg ransom.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll ransom.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\ui-strings.js ransom.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll ransom.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\PresentationUI.resources.dll ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WelcomeCardRdr-2x.png ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\s_listview_18.svg ransom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\resources.pak.DATA ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe ransom.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\de-DE\msadcor.dll.mui ransom.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SMIMES.CFG ransom.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\review_poster.jpg ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HighBeamCardLogo.png ransom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\microsoft_shell_integration.dll ransom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\concrt140.dll ransom.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf ransom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js ransom.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll ransom.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll ransom.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\id_FEMININE.pak ransom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md ransom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll ransom.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5916 ransom.exe 5916 ransom.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransom.exe"C:\Users\Admin\AppData\Local\Temp\ransom.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe1⤵PID:1260
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2820
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:1084
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:2024
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-487906980-2895880840-1957110281-1000\desktop.ini
- Size 129B
- SHA256 1fd28cd697dd7523f585d4cff7f2ca9d654337e8a0724194ebce64d6c264eb50
- MD5 afaed12684fec03043fe2987d66c1606
- SHA1 a390aadf0d8d26adcb44914275c3072acc9b47b0
- SHA512 d766e7bc225f6267da3770317fc821f164aee5a3a1a01127f3a87cc53e252b4b6886be056f08d89d299a97807b28cf0720009c578ac56be2f556a49a907f7fa4
- TLSH T12CB02B05384B280922EA6016BEEC9F104151239781181584C09009B8068DB50794040C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 591B
- SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
- MD5 03c08670d283322f0e61ee3d5dcb7bad
- SHA1 c82040e59df0159f5cc0fd8cc795d4b73c1bf5e2
- SHA512 173493c828071e601a1d823c4c0f325c638aec3166c071a8b39dbb7ce57d84903415b051a5effc6bdd5ea4d2f9dcf8471bcb380a37133ede15ab2017cb2b1986
- TLSH T19BF09707E7A55221C0222638888116F02B25D5D68ECB227381016B5E7EB33002B008B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH