c1c71e6e0d34caf9d41ba02f74ec6eea22c4e680ab1560a872b527263b63db81

Analysis

user interaction
yes
max time kernel
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KORA.exe
Size 339KB
Sample260702-twstashw81
SHA256 c1c71e6e0d34caf9d41ba02f74ec6eea22c4e680ab1560a872b527263b63db81
MD5 5aa26424d7539c1b7f03c5b2db467dba
SHA1 b82354ed8c6124b45650a4e4879f046c9ac0399e
SHA512 474d8bd3abe999034c4e1441d2c062aa5c7860fd136aaacf8c34e7d23562f1e34bc22e7fb8844342bae9b57887e8e3d2693efddc0ab433630a231e79e3c29cf0
SSDEEP 6144:L5bie0CugX7AM3et+2Ivv90PJQijtqO6gaE:dgc7AM2Qv9aJQij
TLSH
T118748E59F7A414F9E2A7C17CCD524505EAB2BC164761ABCF23A00B963F276E08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\$Recycle.Bin\S-1-5-21-3865087520-2734723108-1233268525-1000\desktop.ini	KORA.exe
File created	F:\$RECYCLE.BIN\S-1-5-21-3865087520-2734723108-1233268525-1000\desktop.ini	KORA.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	KORA.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5800	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	3436	vssvc.exe
Token: SeRestorePrivilege	3436	vssvc.exe
Token: SeAuditPrivilege	3436	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 544	1928	KORA.exe	89
PID 544 wrote to memory of 5800	544	cmd.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\KORA.exe
"C:\Users\Admin\AppData\Local\Temp\KORA.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads