Overview

overview

10

Static

static

10

02a08b9942...51.exe

windows10-2004-x64

9

02a08b9942...51.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 03:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851.exe
  • Size 142KB
  • Sample260623-d6g7jsav41
  • SHA256 02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Renames multiple (148) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851.exe
    "C:\Users\Admin\AppData\Local\Temp\02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    PID:3692
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1768
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5944
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2072
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3320
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:6120

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        COMPRESSTRACE.EMF.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\COMPRESSTRACE.EMF.CRYPT
        • Size 878KB
        • SHA256 703a8163eb0038d3ef8f516d6fdeac2835220ea4b32e2c86459928179deae067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CONVERTFIND.DOCX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\CONVERTFIND.DOCX.CRYPT
        • Size 17KB
        • SHA256 4069fb460c62e30132e270fe79757a6ea5c01df7eb6dbece2e5461a05a760b52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CONVERTFROMSTART.MOV.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\CONVERTFROMSTART.MOV.CRYPT
        • Size 516KB
        • SHA256 174ffe158c43109e5700a1834c6fb17b6ce34138d8deb37e12008df36f4861cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        COPYSUSPEND.FON.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\COPYSUSPEND.FON.CRYPT
        • Size 906KB
        • SHA256 aa2ba1f046da090f89d3836a3bb6c5e20293316ae27270e1174a30253fb41ac4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DISABLEUPDATE.XLSX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\DISABLEUPDATE.XLSX.CRYPT
        • Size 11KB
        • SHA256 c1f10073d72ab4029b63d99cc5ace55533e7bf8f745988f5220bd39bda8f00ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EDITDENY.HTM.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\EDITDENY.HTM.CRYPT
        • Size 683KB
        • SHA256 9150a246e92bc84304ede547110749ed7d974814f51a534ce68e9c43272838ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ENTERSPLIT.M4A.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\ENTERSPLIT.M4A.CRYPT
        • Size 460KB
        • SHA256 f686f722bf07b669372eb057434b8d6ea22f49ed654ee245de005f76c40e7c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FORMATDISCONNECT.XLSX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\FORMATDISCONNECT.XLSX.CRYPT
        • Size 13KB
        • SHA256 180d8f1676178f9edf17939e8f78553ee991fc71731c73d73a918b485a854c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HIDEUNPROTECT.WMV.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\HIDEUNPROTECT.WMV.CRYPT
        • Size 599KB
        • SHA256 590a67bdfa4103b9c51824fd44c8e60a25ace4ec1f98159171a4f5ab2b8c7af5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INITIALIZESEND.RMI.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\INITIALIZESEND.RMI.CRYPT
        • Size 544KB
        • SHA256 399ba024457996d18af96feae89a072eaf403a7e62c8e7643cfac7d89aea812f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        JOINEXIT.XLSX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\JOINEXIT.XLSX.CRYPT
        • Size 11KB
        • SHA256 7cfe3488e32ea41ef2e1f0db9d0f4a9d40918c8b6be7cecbb0437dca8059b25a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LOCKTRACE.VB.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\LOCKTRACE.VB.CRYPT
        • Size 711KB
        • SHA256 5043d261f04fc12ae599a4574630c8d92996b1c0b5350ef7bea5ef89eec3818f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NEWRESIZE.LOCK.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\NEWRESIZE.LOCK.CRYPT
        • Size 934KB
        • SHA256 df53a29297d9b2f6b054bdd1b350a0e561b4db61f675060b798a5068ed9366a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RECEIVEENTER.MPG.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\RECEIVEENTER.MPG.CRYPT
        • Size 961KB
        • SHA256 02b7419f180cec670c9fdb11d34b4a8ee3b54b39c9c12f441a597a3e2102fc3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        REMOVEWRITE.MP2.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\REMOVEWRITE.MP2.CRYPT
        • Size 739KB
        • SHA256 536de6d9f135d1536795174b4c098bb617a978e45445e20fb99a76863babd677
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RESTOREDEBUG.AU3.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\RESTOREDEBUG.AU3.CRYPT
        • Size 989KB
        • SHA256 a46d25341722a74cafd1cf1d39ee00e748fb1a540103b177fa021713e765d9a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RESUMERENAME.RLE.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\RESUMERENAME.RLE.CRYPT
        • Size 432KB
        • SHA256 591227c9a5c77e385df74f689c5aba0b0776fd489333f522420e8aa28ae4bbdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SAVECONVERTTO.DWFX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\SAVECONVERTTO.DWFX.CRYPT
        • Size 822KB
        • SHA256 561733fe19ee1a0018dc70c2b4c69e7fef270f44db00012b7c520ba87b05525e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SENDBLOCK.3GP.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\SENDBLOCK.3GP.CRYPT
        • Size 627KB
        • SHA256 b75c16dc48401ffa957410e3e0009edb2fa5857eba1d3ed77b301bb0564f6384
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETJOIN.AIF.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\SETJOIN.AIF.CRYPT
        • Size 766KB
        • SHA256 85d518b38e8ae55b395e4663b9dddef64f767b4b3fbe83b4bc07042ca83056ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHOWINSTALL.PHP.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\SHOWINSTALL.PHP.CRYPT
        • Size 404KB
        • SHA256 48886c94f8269e508863f63e20c555f52ce436358cf6e0a3093e0a2eb1071498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SKIPBLOCK.EPS.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\SKIPBLOCK.EPS.CRYPT
        • Size 794KB
        • SHA256 0e4dc5ea18e8b337425ad39153fc122dc0433a8673faa6e18c3a01f3d321abb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        STEPLIMIT.DOCM.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\STEPLIMIT.DOCM.CRYPT
        • Size 655KB
        • SHA256 c3c197ce9612dfdf881714f2feaaa6a12be3ae45ba1c467ee59dbeaf8bf831fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SUBMITCLOSE.EPRTX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\SUBMITCLOSE.EPRTX.CRYPT
        • Size 571KB
        • SHA256 8e5e99c4445ca0a70488cea8d65335b68142fb2343773b7e03837090ee3b0635
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SUBMITTRACE.PPSM.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\SUBMITTRACE.PPSM.CRYPT
        • Size 377KB
        • SHA256 c30c799a2981c5f89b38405329305c8de4311536f1099e1ac6ca5a5b25eda424
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TESTBLOCK.WMA.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\TESTBLOCK.WMA.CRYPT
        • Size 850KB
        • SHA256 93c439cae28b8662e220431f7b601a96792076a822336fb5ac8a7ddbb26d76f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TESTDISCONNECT.VSSM.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\TESTDISCONNECT.VSSM.CRYPT
        • Size 1.3MB
        • SHA256 1134dd30960f4ed0cad3752a3cd50f7f7d1d7a8e37b2f1ecb009f359ef02ac5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UNDOSYNC.NFO.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\UNDOSYNC.NFO.CRYPT
        • Size 349KB
        • SHA256 80cf3b82b4b6bd892815e2802dd1e9d10a85580a66191099167f2fe33f63c60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UNLOCKCOMPARE.VSTM.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\UNLOCKCOMPARE.VSTM.CRYPT
        • Size 488KB
        • SHA256 06d75eec25d511d474f58653a71a252a765419b4eec585fc7fedb00312cd2c2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        USEHIDE.DOCX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\USEHIDE.DOCX.CRYPT
        • Size 20KB
        • SHA256 64b1267c3592739a239fdc2865e81c16180ed794a9d0884c4763378a4f73edda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ACROBAT READER DC.LNK.CRYPT
        • Path C:\USERS\PUBLIC\DESKTOP\ACROBAT READER DC.LNK.CRYPT
        • Size 3KB
        • SHA256 2925ec9570a90431b823ac0d634ae9b8496769cfc8ab83d869c6898e086a599c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FIREFOX.LNK.CRYPT
        • Path C:\USERS\PUBLIC\DESKTOP\FIREFOX.LNK.CRYPT
        • Size 2KB
        • SHA256 889a5d858eed61e958e86f70769d69d67c6d4a275e82ddedf4f178c47079d729
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GOOGLE CHROME.LNK.CRYPT
        • Path C:\USERS\PUBLIC\DESKTOP\GOOGLE CHROME.LNK.CRYPT
        • Size 3KB
        • SHA256 a8b7b23fc3895b5431dbf81e651e0aec76d445c9f8acb9ee7ab92a59de5179e8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VLC MEDIA PLAYER.LNK.CRYPT
        • Path C:\USERS\PUBLIC\DESKTOP\VLC MEDIA PLAYER.LNK.CRYPT
        • Size 1KB
        • SHA256 8ff42e9216259d4aace1991b527df85e00b7c6bd38e57cb495d87e348cadc894
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DECRYPT_NOTE.txt
        • Path C:\Users\Admin\Desktop\DECRYPT_NOTE.txt
        • Size 1KB
        • SHA256 65f382c9e2a67edba44baa9802dd0d9227b73a0715d925fdf48422733175e7f5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3320-395-0x000002BB801E0000-0x000002BB802E0000-memory.dmp
        Download

        memory/3320-394-0x000002BB801E0000-0x000002BB802E0000-memory.dmp
        Download

        memory/3320-393-0x000002BB801E0000-0x000002BB802E0000-memory.dmp
        Download

        memory/3320-402-0x000002BB83C90000-0x000002BB83CB0000-memory.dmp
        Download

        memory/3320-399-0x000002BB83A30000-0x000002BB83A50000-memory.dmp
        Download

        memory/3320-400-0x000002BB93E70000-0x000002BB93F70000-memory.dmp
        Download

        memory/3320-427-0x000002BB94680000-0x000002BB946A0000-memory.dmp
        Download

        memory/6120-545-0x000001EB7E4A0000-0x000001EB7E8D4000-memory.dmp
        Download