Overview

overview

10

Static

static

3

BitcoinWallet.exe

windows10-2004-x64

10

BitcoinWallet.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    121s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 18:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BitcoinWallet.exe
  • Size 30KB
  • Sample260703-xapfjaet2x
  • SHA256 95ccdb851cc0ff41ad4b2c4bcf30ac26a94598cb6c8ceb5ea0e3f369c364199b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionexecutionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\!

Ransom Note
  • ╔══════════════════════════════════════════════════════╗ ║ !!! HOWS THAT TENDER ANUS FEEL ?!! ║ ╠══════════════════════════════════════════════════════╣ ║ ║ ║ All your important files have been encrypted with ║ ║ AES-256. ║ ║ ║ ║ To recover them, you must enter the correct ║ ║ unlock key on the locked screen. ║ ║ ║ ║ SEND $5,000 IN BITCOIN TO: ║ ║ 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa ║ ║ ║ ║ After payment, you will receive the unlock key. ║ ║ ║ ║ DO NOT attempt to decrypt files manually — ║ ║ they will be permanently destroyed. ║ ║ ║ ║ ATTEMPTS REMAINING: 0 ║ ║ ║ ╚══════════════════════════════════════════════════════╝
Wallets

  • 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa

Signatures

  • Renames multiple (381) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 1 IoCs
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 24 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 54 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\BitcoinWallet.exe
    "C:\Users\Admin\AppData\Local\Temp\BitcoinWallet.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sysmon.ps1"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2584
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4624
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3460
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3648
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
      PID:4324
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
        PID:4164
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\!
          2⤵
            PID:2964

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              C2RManifest.Proof.Culture.msi.16.es-es.xml
              • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml
              • Size 23KB
              • SHA256 db345271be54c8dbe0afcbcd3907c30f9d129718cb37c0ddb907992739e221c5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              !
              • Path C:\USERS\ADMIN\DESKTOP\!
              • Size 1KB
              • SHA256 8f2e8c4beee3ba7fb08bdd17e61872eeb6436202f1df696d2b0eb1c531c00698
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              COPYGRANT.DOCX.ENCRYPTED
              • Path C:\USERS\ADMIN\DESKTOP\COPYGRANT.DOCX.ENCRYPTED
              • Size 18KB
              • SHA256 8547e91d00c20688b809772c26217342bdae11864615d2474cd6adc8e2d2ae41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DENYMOUNT.XLSX.ENCRYPTED
              • Path C:\USERS\ADMIN\DESKTOP\DENYMOUNT.XLSX.ENCRYPTED
              • Size 11KB
              • SHA256 f10392601639a6bed3f21f908454249697b6adbaff61b9eeda00ce89ea0cd15a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DESKTOP.INI.ENCRYPTED
              • Path C:\USERS\ADMIN\DESKTOP\DESKTOP.INI.ENCRYPTED
              • Size 304B
              • SHA256 bd60cd1f3db3f574be5909d040225d7851a4faed89d6fa09f4c7bfcd0d39748e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              DISMOUNTFORMAT.XLSX.ENCRYPTED
              • Path C:\USERS\ADMIN\DESKTOP\DISMOUNTFORMAT.XLSX.ENCRYPTED
              • Size 11KB
              • SHA256 f9c01abc0316a1b76a092f4dde22ecb57006d5cde9f5f053b8c556e38409a72b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PUSHDEBUG.MOV.ENCRYPTED
              • Path C:\USERS\ADMIN\DESKTOP\PUSHDEBUG.MOV.ENCRYPTED
              • Size 211KB
              • SHA256 60fae4f6b3162001b8b7e093e71bd42072c94cdffa07b2457f3f08480c830c51
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WRITEUNBLOCK.ZIP.ENCRYPTED
              • Path C:\USERS\ADMIN\DESKTOP\WRITEUNBLOCK.ZIP.ENCRYPTED
              • Size 148KB
              • SHA256 e1da55a3af1abdac55ed931bf08e1b5b991c04dee70613955ca5f64a86e96934
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DESKTOP.INI.ENCRYPTED
              • Path C:\USERS\PUBLIC\DESKTOP\DESKTOP.INI.ENCRYPTED
              • Size 192B
              • SHA256 17e3d5bddca5c1a2223a5ecb46160a2eb0a0c05d5602cdd2cda97cec2b4b7dcd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              LocalMruGameList.json.encrypted
              • Path C:\Users\Admin\AppData\Local\Microsoft\GameDVR\GameMRU\LocalMruGameList.json.encrypted
              • Size 32B
              • SHA256 33e2f4385a4f0e1d227463e784c841cd370ea37f7396fed102bf5fdfbae36bb6
              • MD5 SHA1 SHA512
              Submit Download

              winword.exe.db
              • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db
              • Size 24KB
              • SHA256 16a920af53a6ae498ed77ac5b76d815c989551b8bb160cb32d6e0e1812c2ea14
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ErrorPage.html
              • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html
              • Size 6KB
              • SHA256 f506d60a6627b53b86beb779110333c433a730cee8583a2007d8aefab01bbb41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QuotaError.png
              • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png
              • Size 9KB
              • SHA256 9f5e8384d9f1d4ced05b7a3f30bce8e471a44eb37e2219f028d12bc0260af1b9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 599B
              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              microsoftwindows.client[1].xml
              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\INOC2O4U\microsoftwindows.client[1].xml
              • Size 97B
              • SHA256 c25b2d6f0b40df7f7587509576ac0e2418943383d2e853f6ad68a1ef7f4f0d6f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sysmon.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\sysmon.ps1
              • Size 171B
              • SHA256 d32c433fbcdccd1dc6cfa728404526a04b2608d8aaf137ed28eeecd3615738f5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              NewRevoke.mp3
              • Path C:\Users\Admin\AppData\Roaming\FindSet\NewRevoke.mp3
              • Size 181KB
              • SHA256 98ce8f05eded109f9521e2e46f7d35d1c1425ce04f969b73e3c55f7d37144b6c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TraceShow.mp3
              • Path C:\Users\Admin\AppData\Roaming\TraceShow.mp3
              • Size 381KB
              • SHA256 49d2a0ceb356c7661fb83620ca3d484534a9830f2b9a5b435d293c9756d0e125
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              !
              • Path C:\Users\Admin\Desktop\!
              • Size 1KB
              • SHA256 8e389d30f00786bc08442b388083cfbf1ec93007113bcbefb9f2ee55b48e2332
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              PushDebug.mov
              • Path C:\Users\Admin\Desktop\PushDebug.mov
              • Size 211KB
              • SHA256 2e01bedd64f4905c75e9cdefbe19cb6b1e8107d5474514df702351aa41a669e6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TraceUninstall.xlsx
              • Path C:\Users\Admin\Documents\TraceUninstall.xlsx
              • Size 460KB
              • SHA256 c5a4b7f2f3a92a44abb2be6cd92cb4ecd16268fb38c0156753c745069ff5e4d1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DisableEdit.dxf
              • Path C:\Users\Admin\Music\DisableEdit.dxf
              • Size 360KB
              • SHA256 5a6ba8ce6f14fb8085159d8f2fe50ff52cf370daf692ae7d1ffc341dd723c442
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/2584-986-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/2584-992-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/2584-983-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/2584-984-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/2584-985-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/2584-980-0x0000025533620000-0x0000025533642000-memory.dmp
              Download

              memory/2584-993-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/2584-988-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/2584-989-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/2584-990-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/3460-1053-0x0000017A03A30000-0x0000017A03A50000-memory.dmp
              Download

              memory/3460-1025-0x0000017A001E0000-0x0000017A002E0000-memory.dmp
              Download

              memory/3460-1024-0x0000017A001E0000-0x0000017A002E0000-memory.dmp
              Download

              memory/3460-1086-0x0000017A152A0000-0x0000017A152C0000-memory.dmp
              Download

              memory/3460-1065-0x0000017A03E20000-0x0000017A03E40000-memory.dmp
              Download

              memory/3460-1054-0x0000017A03EA0000-0x0000017A03FA0000-memory.dmp
              Download

              memory/3460-1026-0x0000017A001E0000-0x0000017A002E0000-memory.dmp
              Download

              memory/3648-1237-0x00000200F25A0000-0x00000200F2C31000-memory.dmp
              Download

              memory/4928-143-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-225-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-8-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-6-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-5-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-4-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-3-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-2-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-117-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-49-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-284-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-996-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-995-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-994-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-311-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download

              memory/4928-0-0x00007FFDDE1AF000-0x00007FFDDE1B0000-memory.dmp
              Download

              memory/4928-1-0x00000000004A0000-0x00000000004B0000-memory.dmp
              Download

              memory/4928-1254-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp
              Download