aa2316ff30647295efac2c884b30b6e83a8515c2d2ff1df3c5d6091b404c73a9

max time kernel
598s
max time network
390s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
capa-testfiles-master/0a0882b8da225406cc838991b5f67d11.exe
Size 169KB
Sample260625-sbpepsc15l
SHA256 aa2316ff30647295efac2c884b30b6e83a8515c2d2ff1df3c5d6091b404c73a9
MD5 0a0882b8da225406cc838991b5f67d11
SHA1 ef62537d97d436b6e7c03190ef35e9dbb4ef997d
SHA512 429bca995156f3e017cd76ae5daa65cc3b47bb9bd63a2976905c430dfdcb55539a501d3052a30b6f4c2be9bc821739d4ca5545fd48a6a755b37f2fba20b755a1
SSDEEP 3072:GBDPdVM/v8qiNMiz8lkXOFSb2xaYsucTGgje/4atSakoSJ2KKsdjI40:GhPH+4CiU7F3snW4wSAstI1
TLSH
T169047C9272D1D236E462083905F9D6FC892CBD71DBA08BD76BC1152CCE629E395B0F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\AppV\Setup\YOUR_FILES_ARE_ENCRYPTED.HTML

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset='utf-8'> <meta name='viewport' content='width=device-width,initial-scale=1'> <title></title> <style> html, body { background-color: #1a1a1a; } body { padding-top: 3rem !important; } #text h2 { color: white; font-size: 2rem; font-weight: 600; line-height: 1.125; } .tabs { -webkit-overflow-scrolling: touch; align-items: stretch; display: flex; font-size: 1rem; justify-content: space-between; overflow: hidden; overflow-x: hidden; overflow-x: auto; white-space: nowrap; } .tabs ul { align-items: center; border-bottom-color: #454545; border-bottom-style: solid; border-bottom-width: 1px; display: flex; flex-grow: 1; flex-shrink: 0; justify-content: flex-start; } .tabs.is-toggle ul { border-bottom: none; } .tabs li { position: relative; } .tabs li { display: block; } .tabs.is-toggle li.is-active a { background-color: white; border-color: white; color: rgba(0, 0, 0, 0.7); z-index: 1; } .tabs.is-toggle li:first-child a { border-top-left-radius: 3px; border-bottom-left-radius: 3px; } .tabs li.is-active a { border-bottom-color: white; color: white; } .tabs.is-toggle a { border-color: #454545; border-style: solid; border-width: 1px; margin-bottom: 0; position: relative; } .tabs a { align-items: center; border-bottom-color: #454545; border-bottom-style: solid; border-bottom-width: 1px; color: white; display: flex; justify-content: center; margin-bottom: -1px; padding: 0.5em 1em; vertical-align: top; cursor: pointer; } .tabs.is-toggle li:last-child a { border-top-right-radius: 3px; border-bottom-right-radius: 3px; } .container { max-width: 1152px; max-width: ; flex-grow: 1; margin: 0 auto; position: relative; width: auto; } .box { background-color: #242424; color: white; display: block; padding: 1.25rem; border: 1px solid #303030; } blockquote { background: hsl(0, 0%, 20%); padding: 1rem; border-left: 3px solid #55a630; } a { color: #e55934; } </style> <script> let text = { en: `<h2> Whats Happen? </h2> We got your documents and files encrypted and you cannot access them. To make sure we�re not bluffing just check out your files. Want to recover them? Just do what we instruct you to. If you fail to follow our recommendations, you will never see your files again. During each attack, we copy valuable commercial data. If the user doesn’t pay to us, we will either send those data to rivals, or publish them. GDPR. Don’t want to pay to us, pay 10x more to the government. <h2> What Guarantees? </h2> We’re doing our own business and never care about what you do. All we need is to earn. Should we be unfair guys, no one would work with us. So if you drop our offer we won’t take any offense but you’ll lose all of your data and files. How much time would it take to recover losses? You only may guess. <h2> How do I access the website? </h2> <ul> <li><a href="https://torproject.org" target="_blank">Get TOR browser here</a></li> <li><a href="http://ebwexiymbsib4rmw.onion/chat.html?3ae8455ac4-66f2dd334a-909af65594-70fad264c4-ef05a33ef3-16b4f6e8cc-3b9a414226-5e377436ee">Go to our website</a></li> </ul>`, de: `<h2> Was ist gerade passiert? </h2> Wir haben Ihre Dokumente und Dateien verschlüsselt und Sie können nicht mehr darauf zugreifen. Jeder Angriff wird von einer Kopie der kommerziellen Informationen begleitet. Um sicherzustellen, dass wir es ernst meinen, prüfen Sie einfach Ihre Dateien und Sie werden sehen. Möchten Sie sie wiederherstellen? Halten Sie sich einfach an unsere Anweisungen, um uns zu bezahlen. Tuen Sie dies nicht, werden Sie Ihre Dateien niemals wiedersehen. Im Falle einer Zahlungsverweigerung werden die Daten entweder an Wettbewerber verkauft oder in offenen Quellen bereitgestellt. GDPR. Wenn Sie uns nicht bezahlen möchten, zahlen Sie das Zehnfache an der Regierung. <h2> Wie sollten Sie uns trauen ? </h2> Wir machen unsere eigenen Geschäfte und kümmern uns nicht darum was Sie tunen. Wir müssen nur verdienen. Sollten wir einfach nur bluffen, würde niemand an uns zahlen. Wenn Sie unser Angebot ablehnen, werden Sie alle Ihre Daten für immer verlieren. Wie viel Zeit werden Sie brauchen um ihre Daten selber zu ersetzen ? Sie können es sich schon denken. <h2> Unsere Forderungen </h2> <ul> <li><a href="https://torproject.org" target="_blank">Holen Sie sich den TOR-Browser hier</a></li> <li><a href="http://ebwexiymbsib4rmw.onion/chat.html?3ae8455ac4-66f2dd334a-909af65594-70fad264c4-ef05a33ef3-16b4f6e8cc-3b9a414226-5e377436ee">Gehen Sie auf unsere Website</a></li> </ul>`, fr: `<h2> Qu'est-ce qui vient de se passer? </h2> Nous avons crypté vos documents et fichiers et vous ne pouvez pas y accéder. Chaque attaque est accompagnée d'une copie des informations commerciales. Pour vous assurer que nous ne bluffons pas. Voulez-vous les restaurer? Faites juste ce que nous vous demandons, pour nous payer. Si vous ne suivez pas nos recommandations, vous ne verrez plus jamais vos fichiers. En cas de refus de paiement - les données seront soit revendues à des concurrents, soit diffusées dans des sources ouvertes. GDPR. Si vous ne voulez pas nous payer, payez x10 fois le gouvernement. <h2> Qu'en est-il des garanties? </h2> Nous faisons nos propres affaires et ne nous soucions jamais de ce que vous faites. Tout ce dont nous avons besoin est de gagner de l'argent. Si nous devions être injustes, personne ne travaillerait avec nous. Donc, si vous abandonnez notre offre, nous ne prendrons aucune infraction, mais vous perdrez toutes vos données et vos fichiers. Combien de temps faudrait-il pour récupérer les pertes? Vous pouvez seulement deviner. <h2> Comment puis-je accéder au site web? </h2> <ul> <li><a href="https://torproject.org" target="_blank">Téléchargez le navigateur TOR ici</a></li> <li><a href="http://ebwexiymbsib4rmw.onion/chat.html?3ae8455ac4-66f2dd334a-909af65594-70fad264c4-ef05a33ef3-16b4f6e8cc-3b9a414226-5e377436ee">Allez sur notre site web</a></li> </ul>`, es: `<h2> ¿Lo que de pasar? </h2> Ya tenemos sus documentos y archivos encriptados y usted no puede acceder a ellos. Para asegurarse de que no estamos faroleando. ¿Quiere recuperarlos? Sólo haga lo que le indicamos. Si usted no sigue nuestras recomendaciones, usted nunca verá sus archivos. Durante cada ataque, copiamos los datos comerciales valiosos. Si el usuario no nos paga, enviaremos estos datos a sus rivales o los publicaremos. GDPR. No quiere pagarnos, paga 10 veces más al gobierno. <h2> ¿Qué pasa con las garantías? </h2> Estamos haciendo nuestro propio negocio y nunca nos importa lo que hace usted. Todo lo que necesitamos es ganar. Hay que ser injustos chicos, nadie trabajaría con nosotros. Entonces, si deja caer nuestras propuestas, no nos ofenderemos pero usted perderá todos sus datos y archivos. ¿Cuánto tiempo se requiere para recuperar las pérdidas? Sólo usted puede adivinar. <h2> ¿Cómo acceder al sitio web? </h2> <ul> <li><a href="https://torproject.org" target="_blank">Obtenga el navegador TOR aquí</a></li> <li><a href="http://ebwexiymbsib4rmw.onion/chat.html?3ae8455ac4-66f2dd334a-909af65594-70fad264c4-ef05a33ef3-16b4f6e8cc-3b9a414226-5e377436ee">Vaya a nuestro sitio web</a></li> </ul>`, jp: `<h2> 何があったのですか？ </h2> ドキュメントとファイルを暗号化しました。それらにアクセスすることはできません。ブラフしないようにするには、ファイルをチェックアウトして、すべてが。それらを回復したいですか？ただやる指示すること。指示に従わない場合、ファイルは二度と表示されません。各攻撃中に、貴重な商用データをコピーします。ユーザーが当社に支払わない場合は、それらのデータをライバルに送信するか、公開します。 <h2> 何が保証されますか ? </h2> 私たちは私たち自身のビジネスを行っており、あなたが何をするかを気にしません。必要なのは稼ぐことだけです。私たちが不公平な人である場合、誰も私たちと一緒に働くことはありません。ですから、あなたが私たちの申し出をやめても、私たちは何の罪も犯しませんすべてのデータとファイルが失われます。損失を回復するのにどれくらい時間がかかりますか？推測するだけです。 <h2> Webサイトにアクセスするにはどうすればよいですか？ </h2> <ul> <li><a href=" https://torproject.org " target="_blank">ここで TORブラウザを入手 </a></li> <li><a href="http://ebwexiymbsib4rmw.onion/chat.html?3ae8455ac4-66f2dd334a-909af65594-70fad264c4-ef05a33ef3-16b4f6e8cc-3b9a414226-5e377436ee">当社のウェブサイトにアクセス </a></li> </ul>` }; function sel_lang(event) { let active = document.getElementsByClassName('is-active')[0]; active.classList.remove('is-active'); event.target.parentElement.classList.add('is-active'); let lang = event.target.getAttribute('data-lang'); let el = document.getElementById('text'); el.innerHTML = text[lang]; } document.addEventListener("DOMContentLoaded", ()=>{ let el = document.getElementById('text'); el.innerHTML = text['en']; }); </script> </head> <body class='pt-6'> <div class='container'> <div class="tabs is-toggle"> <ul> <li class="is-active"><a onclick='sel_lang(event);' data-lang='en'>EN</a></li> <li class=""><a onclick='sel_lang(event);' data-lang='de'>DE</a></li> <li class=""><a onclick='sel_lang(event);' data-lang='fr'>FR</a></li> <li class=""><a onclick='sel_lang(event);' data-lang='es'>ES</a></li> <li class=""><a onclick='sel_lang(event);' data-lang='jp'>JP</a></li> </ul> </div> <div class='box'> <div id='text'></div> <div style='border: 1px solid red; padding: .5rem; font-size: 1.3rem; font-weight: 500; margin: 3rem 0;'> <div class='title is-4'> In case you decide not to cooperate, your private data will be published <a style='color: #46a049; text-decoration: underline;' target='_blank' href='http://nbzzb6sa6xuura2z.onion/'>here</a> or sold. </div> </div> <div style='margin-top: 2rem;'> <h2>Offline how-to</h2> <p>Copy & Paste this secret message to <a href="http://ebwexiymbsib4rmw.onion">this page</a> textarea field</p> <p><blockquote>1d40360975a73e1b1de8fcf45f1c9fc7e0b25d71c09e68f1a68f2560bad7ffe787751509e27fa3b8db2d132c8619f978</blockquote></p> </div> </div> </div> </body> </html>��

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\YOUR_FILES_ARE_ENCRYPTED.HTML	0a0882b8da225406cc838991b5f67d11.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 28 IoCs

description	ioc	Process
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Public\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	0a0882b8da225406cc838991b5f67d11.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\V:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\W:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\E:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\T:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\A:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\L:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\B:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\N:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\M:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\U:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\I:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\O:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\P:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\G:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\H:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\Z:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\X:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\R:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\K:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\Q:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\Y:	0a0882b8da225406cc838991b5f67d11.exe
File opened (read-only)	\??\S:	0a0882b8da225406cc838991b5f67d11.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a0882b8da225406cc838991b5f67d11.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2908	vssvc.exe
Token: SeRestorePrivilege	2908	vssvc.exe
Token: SeAuditPrivilege	2908	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\0a0882b8da225406cc838991b5f67d11.exe
"C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\0a0882b8da225406cc838991b5f67d11.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YOUR_FILES_ARE_ENCRYPTED.HTML

Path C:\ProgramData\Microsoft\AppV\Setup\YOUR_FILES_ARE_ENCRYPTED.HTML
Size 15KB
SHA256 43997f9e6d4f10288ee0272bae74eb43ef71742b860bb1c1618d7fd09d0b26a3
MD5 0194a99090f18b0bdd758a3176f53d46
SHA1 482a6399a8fd3e2402fed108a351f308be68847b
SHA512 754e49ac30976d88876edbbb433979d8c291503ba9bacd1ff0cde889a9526eda316e9d3820b4e163f55b63e4965bd0070f9b84c5a3fa07c2320667d40153ab60
SSDEEP 192:Dnzcyc1zLuntm2petn2knAk/Hl65G/blrkczLGUxu/FDO+bASsR4IVu01T:D75w13LGPDfvsz0
TLSH
T11A62D62FA6E224A6C20353796F1597F5B323696BC589F761B95EC3081F083C4D893B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis