Analysis
- max time kernel
5s - max time network
12s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-de - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 19:02
Behavioral task
behavioral1
Sample
ransomware_sample.exe
Resource
win10v2004-20260513-de
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ransomware_sample.exe
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
4 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target ransomware_sample.exe
- Size 12.8MB
- Sample260709-xpvabsg171
- SHA256 6d6b6adf92e9cddf4dcad0405889d9b84033fc6841e2a8f04221f2a34912e75e
- MD5 c30ebd92d248f7c77b42e0afe53f445e
- SHA1 18469fb4e4a6af5bbc4bfff4270be770fbe47817
- SHA512 a5b9b73c05fcc4499632ffbd6ce0bd641fd0a4f2e5fc4ca65a66f4563e96003badbf60dee385a82ff9771a7e446b747cf81f2a41aedb26a6432761bf1dd715f5
- SSDEEP 393216:d0AEInuSfdjcMkXEAphVt3QSg+oONK4vFgtS:mJ6TdjcMkRph7o+rNpvFg
- TLSH T1D1D6336CA39045EEF8F3C13D69C19461F7F1B8503F21D2EB17A19A191E3BAD14D388A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 13 IoCs
pid Process 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe 5292 ransomware_sample.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1192 WMIC.exe 1192 WMIC.exe 1192 WMIC.exe 1192 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1192 WMIC.exe Token: SeSecurityPrivilege 1192 WMIC.exe Token: SeTakeOwnershipPrivilege 1192 WMIC.exe Token: SeLoadDriverPrivilege 1192 WMIC.exe Token: SeSystemProfilePrivilege 1192 WMIC.exe Token: SeSystemtimePrivilege 1192 WMIC.exe Token: SeProfSingleProcessPrivilege 1192 WMIC.exe Token: SeIncBasePriorityPrivilege 1192 WMIC.exe Token: SeCreatePagefilePrivilege 1192 WMIC.exe Token: SeBackupPrivilege 1192 WMIC.exe Token: SeRestorePrivilege 1192 WMIC.exe Token: SeShutdownPrivilege 1192 WMIC.exe Token: SeDebugPrivilege 1192 WMIC.exe Token: SeSystemEnvironmentPrivilege 1192 WMIC.exe Token: SeRemoteShutdownPrivilege 1192 WMIC.exe Token: SeUndockPrivilege 1192 WMIC.exe Token: SeManageVolumePrivilege 1192 WMIC.exe Token: 33 1192 WMIC.exe Token: 34 1192 WMIC.exe Token: 35 1192 WMIC.exe Token: 36 1192 WMIC.exe Token: SeIncreaseQuotaPrivilege 1192 WMIC.exe Token: SeSecurityPrivilege 1192 WMIC.exe Token: SeTakeOwnershipPrivilege 1192 WMIC.exe Token: SeLoadDriverPrivilege 1192 WMIC.exe Token: SeSystemProfilePrivilege 1192 WMIC.exe Token: SeSystemtimePrivilege 1192 WMIC.exe Token: SeProfSingleProcessPrivilege 1192 WMIC.exe Token: SeIncBasePriorityPrivilege 1192 WMIC.exe Token: SeCreatePagefilePrivilege 1192 WMIC.exe Token: SeBackupPrivilege 1192 WMIC.exe Token: SeRestorePrivilege 1192 WMIC.exe Token: SeShutdownPrivilege 1192 WMIC.exe Token: SeDebugPrivilege 1192 WMIC.exe Token: SeSystemEnvironmentPrivilege 1192 WMIC.exe Token: SeRemoteShutdownPrivilege 1192 WMIC.exe Token: SeUndockPrivilege 1192 WMIC.exe Token: SeManageVolumePrivilege 1192 WMIC.exe Token: 33 1192 WMIC.exe Token: 34 1192 WMIC.exe Token: 35 1192 WMIC.exe Token: 36 1192 WMIC.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1404 wrote to memory of 5292 1404 ransomware_sample.exe 85 PID 5292 wrote to memory of 1564 5292 ransomware_sample.exe 86 PID 1564 wrote to memory of 1192 1564 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransomware_sample.exe"C:\Users\Admin\AppData\Local\Temp\ransomware_sample.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\ransomware_sample.exe"C:\Users\Admin\AppData\Local\Temp\ransomware_sample.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get model 2>nul"3⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\_bz2.pyd
- Size 85KB
- SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
- MD5 207d4a4b7a113ef494514918f2dccdf3
- SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
- SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
- SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
- TLSH T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\_cffi_backend.cp314-win_amd64.pyd
- Size 177KB
- SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
- MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
- SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
- SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
- SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
- TLSH T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\_ctypes.pyd
- Size 139KB
- SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
- MD5 eeabc0c7756ed7a29e33e467c398737f
- SHA1 ec5c401946a9df4e4ab764ddb4639e4e33e1ce40
- SHA512 5e1e93545e1be34880fc680ca12004792076e88baa6cac4512fdbbdb90091a9ae441a16b8d24f64c6b03bf14903babddecfa783ce5c016759ed790c0eabc189b
- SSDEEP 3072:G/n1qQ8/27N56EBZrGwrb1OzIJswKRW2r7rw8IGGPzoGc:wn1JDT6wrszIJfUDwtc
- TLSH T1A3D38F4B336841E6DA678138C6739E47FBB1F4511A10878F4264C99B2F637A2AE3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\_lzma.pyd
- Size 157KB
- SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
- MD5 cada2b240b280f172aeb32a1666b21e6
- SHA1 c15dc39329444433c255309eb89bae188aae1b22
- SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
- SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
- TLSH T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\_socket.pyd
- Size 85KB
- SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
- MD5 7a16a21ad11d3e9829ca3b379a2bb010
- SHA1 90707b5c1662a1e4553f1cc10ba96c7452def7c2
- SHA512 5e0268af7dad1646903ddb5e61fb38896a7ae964cadb38b5c28bc1524a69a87b7c09f501f3f570ec6bf78c8fa873b8fbe062bbe06cf839e32a2735f1efd0cae1
- SSDEEP 1536:hcVuncT0XH3XAJtZypxm7XP+66wSzC/jAjI/Lb6NsQ3cs8PgMr8IGGwby1Ni9DFo:SEny2+jypxm7XPz6wSzC/jAjQOsQssV2
- TLSH T19B835B01A66040FAEB77C176C2639E63FBB4B5C01294A75F1466C55A1F333C2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\_zstd.pyd
- Size 491KB
- SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
- MD5 035b0a033dd00dbe887556f4d4b852c3
- SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
- SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
- SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
- TLSH T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\base_library.zip
- Size 1.3MB
- SHA256 6c5c3c734cc33ef197152ec66275d6be010fe2df455f1e08af6df9859a982386
- MD5 900d72e165a5354b239d62a721b9e567
- SHA1 8ed01c5362b755c9aed2f9ed11f183bd895ff25e
- SHA512 9a52eecf9890b414f4e395f766062ff33c191f05d1c0b945e7e20534aa0ecb922f69693acced8e593114a54f544dc9f2041ffc80a7af96131b4c48052975bbcc
- SSDEEP 24576:xDlbUdNQZ8uUF3LfQeOdP2m2df1BEYYrRphwi:sdNNuUF7/wYARUi
- TLSH T1BE552BA1B9917967FEC9F37A35B75A0CA715C0109B10D303B4A88DAC6FDF260AE558CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\cryptography\hazmat\bindings\_rust.pyd
- Size 8.8MB
- SHA256 92f58bb4f01a75a0ef4dd9425dc2a96ddfe25fc93fd9dc11ea8f0d05b7a4f085
- MD5 c4521bd3ab7f887e06601d75f6100d38
- SHA1 3a2433fa77ec08e938c211f4d59e63bd1cde089e
- SHA512 0485f18134712973fbf67d55ebed4c59b9c6467979e2b6349861c84cb064eeafb94e964bfa28c3fa644318d10d4148a6c042595ce6288de37e4410369713ed30
- SSDEEP 98304:8vYkHms4/TObjd7AM1iG06Oe32rWtnIQ+icVSt4j:hCbxAM1iG06OStxB2
- TLSH T138966C25BAA940A8D86AC4B8C38756339B7174CA077467EF49D486B52F77FE02B3D700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\python3.DLL
- Size 72KB
- SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
- MD5 a5495a547b4218148914469f1ee65d47
- SHA1 91632b2965ae22db25edce6971cf59c0a3a00bba
- SHA512 ab1fe6ec0b21fdac78b17afc0fd3a7573b89647a3e4af846448e285a7989342f4a8eaf191a4e90e81a990f10ff1364dd941a0c7f80c108224d8f6c7cf6bb49d1
- SSDEEP 768:xHQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKp:0bTrnXngXMu8IGG0ly1Ni94fIk0h4
- TLSH T168735D4E6B54F8A2DAB629FC78D199CE242B12FC5F2584DFA47CD3D20D1A310A22735D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\python314.dll
- Size 6.5MB
- SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
- MD5 006b0746b5abaf438d1bc753261c6d2c
- SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
- SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
- SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
- TLSH T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI14042\ucrtbase.dll
- Size 1.1MB
- SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
- MD5 3b337c2d41069b0a1e43e30f891c3813
- SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
- SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
- SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
- TLSH T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
- MD5 SHA1 SHA512 SSDEEP TLSH