Overview

overview

10

Static

static

10

02a08b9942...51.exe

windows10-2004-x64

9

02a08b9942...51.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 02:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851.exe
  • Size 142KB
  • Sample260623-ded1taat7x
  • SHA256 02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Renames multiple (179) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851.exe
    "C:\Users\Admin\AppData\Local\Temp\02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    PID:3372
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3508
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5648
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:684
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5012

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        COMPLETEEXPAND.WAX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\COMPLETEEXPAND.WAX.CRYPT
        • Size 679KB
        • SHA256 0d2d4f205606ffe3c6d64b0c01ead5abaac0db9640aeb7e4fa6e814e1aec0223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CONFIRMGET.PPTM.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\CONFIRMGET.PPTM.CRYPT
        • Size 728KB
        • SHA256 955f77bf9d79a128863109b693da10ad4dbd66dd954ba5d5ffb0b1917f20902d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CONVERTUNINSTALL.PCX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\CONVERTUNINSTALL.PCX.CRYPT
        • Size 558KB
        • SHA256 1e2379b60b15823a291a27fc4384c7f60bac5c0142a8449d1f5f5a5df376903f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DISMOUNTIMPORT.AIF.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\DISMOUNTIMPORT.AIF.CRYPT
        • Size 364KB
        • SHA256 46792c1f28e4f5d4b0c30f253922fdfb4f57cc800f368a381474bd3ae71a3dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DISMOUNTSTEP.SEARCH-MS.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\DISMOUNTSTEP.SEARCH-MS.CRYPT
        • Size 413KB
        • SHA256 d1d66f76dddc3cd4cfa158ccdb56d2d25e1e316d37f95b19d9b3cf47a4d8910f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ENABLEEDIT.MHTML.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\ENABLEEDIT.MHTML.CRYPT
        • Size 873KB
        • SHA256 084d4892c8f83d822095b3ce771dd6043d87e52da2c6ce17e9423c27b91aae16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GETUNBLOCK.XLSX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\GETUNBLOCK.XLSX.CRYPT
        • Size 15KB
        • SHA256 74e45d78800a454eebc73d91edfd60a777c3968111037e4e5f56a49ca1c53765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GRANTREQUEST.PPT.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\GRANTREQUEST.PPT.CRYPT
        • Size 509KB
        • SHA256 a047cafc261c2396f98595ff413b57a53819482bae9e6acefbf5e9d2c4fc2db5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GRANTSEARCH.MPEG.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\GRANTSEARCH.MPEG.CRYPT
        • Size 776KB
        • SHA256 c0f7d26e2f954c5f034f6151d23b895006798a39d8848c419ec14a78532e7c2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IMPORTINITIALIZE.MPE.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\IMPORTINITIALIZE.MPE.CRYPT
        • Size 534KB
        • SHA256 ba0a05b54ce9be78f57eb9fd81012bf1c5a9a00d02b957263ddda7060c2cf9ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INSTALLUNDO.VSDX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\INSTALLUNDO.VSDX.CRYPT
        • Size 388KB
        • SHA256 4491ac07fd113c417677d5dd56c67272ea8b1456ef7be7d16aead3ac94e0cef9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LOCKIMPORT.CAB.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\LOCKIMPORT.CAB.CRYPT
        • Size 340KB
        • SHA256 321fd4480bcf700324cf7e0cafbfc97b1475c4d405ec678b89ff2f0296b20791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MEASURESTOP.XLSX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\MEASURESTOP.XLSX.CRYPT
        • Size 12KB
        • SHA256 48da9a505749f4b9dda0318c0d9cb0d34b2aeda3eae2ccc5a71c49c0be2f1420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OPENSELECT.3GP2.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\OPENSELECT.3GP2.CRYPT
        • Size 485KB
        • SHA256 0afe44e8f0b81b0ad4844983f2cefe6b6f45d3b0570e41dd40ea4e4310701f3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        REPAIRSKIP.GIF.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\REPAIRSKIP.GIF.CRYPT
        • Size 582KB
        • SHA256 abf5b25e368ab25a9e5d919d6960344b119e8df820ce2d85fbec8751beaa2f37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        REQUESTCLEAR.EASMX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\REQUESTCLEAR.EASMX.CRYPT
        • Size 655KB
        • SHA256 013dabeba2ca3e8d0bbc775f904ca1bc4626e6a7489df75bfa2a242a73266375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        REQUESTRENAME.PNG.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\REQUESTRENAME.PNG.CRYPT
        • Size 752KB
        • SHA256 3b3074b43002a933c3c85e6162424da58c2335b8dc0cc00eff712cf82ba9b759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RESETCOMPRESS.DOCX.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\RESETCOMPRESS.DOCX.CRYPT
        • Size 703KB
        • SHA256 be125947a18f8fcdfad81f0f2d529ef8c4cf44349ed3550c5f2dfeeb275d48cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RESETINSTALL.XML.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\RESETINSTALL.XML.CRYPT
        • Size 316KB
        • SHA256 4e01741dd7ff8c84c526703b517209a7f5bac7c7b1ed09d58a61e1c23934cfa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RESOLVECONNECT.WMA.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\RESOLVECONNECT.WMA.CRYPT
        • Size 631KB
        • SHA256 221667c44604d242d46aef15e4bf1f3afecffd81eda7342cb792139464941aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RESTOREWAIT.MHTML.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\RESTOREWAIT.MHTML.CRYPT
        • Size 849KB
        • SHA256 85bd383530cc34ad2f5c88d37448eecf41fd3f1abd5024879d427c24830f741b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SPLITDEBUG.TIF.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\SPLITDEBUG.TIF.CRYPT
        • Size 437KB
        • SHA256 950537ead0836a9cff837abe8fcb7f3ee8eafa5e88b428a10f8a332c2f3dc094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SPLITUNPUBLISH.ZIP.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\SPLITUNPUBLISH.ZIP.CRYPT
        • Size 1.2MB
        • SHA256 71c77ba322d8c76d10a834498591b463649429142df1bf6ebddf6bffc3e3abf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        STARTMEASURE.DIB.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\STARTMEASURE.DIB.CRYPT
        • Size 606KB
        • SHA256 6af7df4a78858b4a125341af078836632b9a6a568895fec8791cc05fdd6d0aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UNBLOCKUNINSTALL.WMF.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\UNBLOCKUNINSTALL.WMF.CRYPT
        • Size 800KB
        • SHA256 9be8d5d4fd46d0bea81f5f612f0da9da917787a2c6a2627ab5829f9a96afe2f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UNPROTECTPUSH.XHTML.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\UNPROTECTPUSH.XHTML.CRYPT
        • Size 825KB
        • SHA256 2a571d72fe20e0984bd875194f84ceb8a8653a3aa28a9be1b5c0e291c979765b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UNREGISTERREGISTER.GIF.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\UNREGISTERREGISTER.GIF.CRYPT
        • Size 461KB
        • SHA256 f72a72c86962a39af5a6434cb3f35df49497c07b287762dcfe0e49807e7a120e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WAITCOMPARE.ODT.CRYPT
        • Path C:\USERS\ADMIN\DESKTOP\WAITCOMPARE.ODT.CRYPT
        • Size 897KB
        • SHA256 bb6372bcd36c71d63f1c50123cb9806ad05ed6894887090565b2d643699435aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ACROBAT READER DC.LNK.CRYPT
        • Path C:\USERS\PUBLIC\DESKTOP\ACROBAT READER DC.LNK.CRYPT
        • Size 3KB
        • SHA256 a4b177dd86e6f826e047d67cc4689441a26a2f06d941c7dd9431edbb11004a94
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FIREFOX.LNK.CRYPT
        • Path C:\USERS\PUBLIC\DESKTOP\FIREFOX.LNK.CRYPT
        • Size 2KB
        • SHA256 0ae76417ff75ce6e4cf482b08848972d20682f7fb44a4277a9eda41fcb1a9d60
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GOOGLE CHROME.LNK.CRYPT
        • Path C:\USERS\PUBLIC\DESKTOP\GOOGLE CHROME.LNK.CRYPT
        • Size 3KB
        • SHA256 be65b533138791ccd3596aae426c8424e4cbb4d880665cb81a3cb756a2afdf61
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VLC MEDIA PLAYER.LNK.CRYPT
        • Path C:\USERS\PUBLIC\DESKTOP\VLC MEDIA PLAYER.LNK.CRYPT
        • Size 1KB
        • SHA256 bc6b77d88ac15b05b7ab68d7eef6ac6c6ecf80a7f4332ebf687f5cc51a567ada
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DECRYPT_NOTE.txt
        • Path C:\Users\Admin\Desktop\DECRYPT_NOTE.txt
        • Size 1KB
        • SHA256 65f382c9e2a67edba44baa9802dd0d9227b73a0715d925fdf48422733175e7f5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/684-453-0x000001AA801E0000-0x000001AA802E0000-memory.dmp
        Download

        memory/684-474-0x000001AA84000000-0x000001AA84020000-memory.dmp
        Download

        memory/684-499-0x000001AA84480000-0x000001AA844A0000-memory.dmp
        Download

        memory/684-465-0x000001AA84060000-0x000001AA84160000-memory.dmp
        Download

        memory/684-464-0x000001AA82C20000-0x000001AA82C40000-memory.dmp
        Download

        memory/684-619-0x000001AA80440000-0x000001AA80623000-memory.dmp
        Download