Overview

overview

10

Static

static

3

BTCWare.zip

windows10-2004-x64

10

Resubmissions

26/07/2026, 18:43

260726-xc6slazxbx

11/07/2026, 10:47

260711-mvs94sgv2m10

Sharing

Copy URL Twitter E-mail

General

  • Target
    BTCWare.zip
  • Size 562KB
  • Sample260711-mvs94sgv2m
  • SHA256 efa1b4bc26d743edcf4335f89d5366e8233f179f46de081612adc71ee9fe4444
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarestealertrojan

Malware Config

Extracted

Path

  • C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\Restore_Your_Files.txt

Ransom Note
  • All Your Files Are Locked And Important Data Downloaded ! Your Files Are No Longer Accessible Don't Waste Your Time, Without Our Decryption Program Nobody Can't Help You . If Payment Isn't Made After A While We Will Sell OR Publish Some Of Your Data . You Don't Have Much Time! Your ID : KTKNT If You Want To Restore Them Email Us : [email protected] If You Do Not Receive A Response Within 24 Hours, Send A Message To Our Second Email : [email protected] To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin . Every Day The Delay Increases The Price !! The Decryption Price Depends On How Fast You Write To Us Email. We Deliver The Decryptor Immediately After Payment , Please Write Your System ID In The Subject Of Your E-mail. What is the guarantee ! Before Payment You Can Send Some Files For Decryption Test. If We Do Not Fulfill Our Obligations, No One Does Business With Us , Our Reputation Is Important To Us It's Just Business To Get Benefits. =============================================================================== Attention ! Do Not Rename,Modify Encrypted Files . Do Not Try To Recover Files With Free Decryptors Or Third-Party Programs And Antivirus Solutions Because It May Make Decryption Harder Or Destroy Your Files Forever ! =============================================================================== Buy Bitcoin ! https://www.kraken.com/learn/buy-bitcoin-btc https://www.coinbase.com/how-to-buy/bitcoin

Extracted

Path

  • C:\Users\Admin\Desktop\ReadMe.hta

Ransom Note
  • <html><head><title>[email protected]</title><style>.spnn { background-color:yellow;} .xsw{color:white;} .Circe1 {display: list-item;padding-left:30px;}.dives{background-color: #eaecee ;border: 1px solid black;padding:30px;}.center {text-align: center;}.vl {border: 1px solid black;background-color:#f2f4f4;margin-left:5px;margin-right:5px;padding:4px;}.Mrgnlf {margin:15px;}.fnt {background-color:red;height:70px;text-align: center;font-size: 3em;} hr.new1 {border: 0;height: 1px;background-image: linear-gradient(to right, rgba(0, 0, 0, 0), rgba(0, 0, 0, 0.75), rgba(0, 0, 0, 0));} h3 {font-size: 12vw;}</style><HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu='no'><script language='javascript'>window.moveTo(100, 100);window.resizeTo((window.screen.width)-150,(window.screen.height)-150);</script></head><body><div class="center"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAE4AAABlCAYAAADjwdXoAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAAAjNSURBVHhe7Z1ZyE1dGMfXe8wziQyZScpYKC4QJRdmF+SOzCEiCReiZMibOURCIQol4UKGkMgsLlyQzGWe58/v+fZ6v+P43rPXXmefs5be/avT2Xuf95y9938/a63nedbwFv38hfKMDx8+qM+fP8t2xYoVVbVq1WTbJ5wKd+TIEXXq1Cl14sQJdfHiRWVyKR07dlR9+vRRPXr0UKNGjQqO/gvfLyoqCvbyS8GF27Jli1q3bp26du2a7JcrV06sqkKFCrKdTqYI379/V1+/flVfvnxR3759k2NNmzZVkydPVnPnzpX9QlEQ4d6/f6+mTJmiduzYIftVqlRRlStXlm1btHUhIr8P/fr1Uxs3blStW7eW/XySd+FGjBih9u/fr8qXL6+qV6+et6LEbXz69EleXbp0UceOHVP16tULPo2fVPAeO0uXLhWRDh06pGrXrq1q1KiR1/qH38aS69Spo27fvq3q16+vxo8fH3waP7FbHPVQs2bN1MOHD+Um+Pl8ClYanPfVq1eyfffuXdW8eXPZjotYLe706dNSJJ8/fy6igQvRgPNqS2/RooVauXJl8Ek8xCbc4sWLVe/eveViKTI+gHg8SK5p9uzZf7gvuZBTUdXFcNKkSWrTpk1yga4szISXL1+KD4jfmGsVkpPFceLp06eLaLpo+gzXePLkSdW3b9+cH3BOwq1Zs0atXbvWaSMQFa4Vi8u12FoX1Zs3b6oOHTrELhqtMq8fP37I76ZSKamnMqOKXOB3aXHXr18vjrkN1sIhVM2aNXO6IU7Ni6CeUErTrl07cV4RjRb6zp074tgC5yPo5zPbh6VvGfFwmxo1aiT7UbASrmvXrurGjRuqatWq1hePVb1580a2cVRHjx4tFXc2rl69qnbt2qVWrVolQiMgca4tOgOjQ7YoRK7jCJ8uXbokF20jGs+J1o2iuGfPHtnfvHlzqGjQuXNntXz5colPz58/rxo0aFDyWzYgOtY+derU4Ig5kS0ulyKqA/Li4mI1c+bM4GhuENINHjzYOm/H7VNksX6cZVMiWdy8efPk3UY0LgzRES4u0WDQoEFy84RUWF9UuCZSWkOHDg2OmBHJ4jiJjZPLDZHqoZLPJ9STu3fvjuxTaqu7f/++atKkSXA0O8YWR7bDBiytTZs2eRcNaDgQL6rlYQi4PLNmzQqOhGNscdQhJB85gSm0fLgNr1+/Do4UBtLrt27dkrrYFG11pgXQyOLIeiBCFNHg3bt34raA6QXFwfXr1+V8uDym6OqHFt4EI+EoAlEbBIrLwoULpU8AotaLuXL48OESP9EU/FLcHROMiio3TVNtanF0pPCdQhfRTDp16iR1q2n/BlKYFtdQi6OlgSgW9/btW+eiAT1pHz9+DPbC0aVi79698p6NUOGOHj0q76ZFzdaLzxetWrX6LQ4OAwOhjzeMUOGuXLkSqVEgGMcp9YVhw4ZJI2UK3oM2lmyECnfmzBnxrE0hcB45cmSw554ZM2YEW2Zwr6TMwghtHDBdGgb8MRNoTaPGffkEl4TGQaeiTOAewhqI0F+izopSv1WqVMmbzhrgwZPf00MmwtB19LNnz+S9NMwegSE83caNG0d2lPMN8aepM6yt8smTJ/JeGrEKh3kzzME3KKYmvlk6YW5MrMKBabEuJDbXFPad2IUrKyTCWZIIZ0kinCWJcJYkwlmSCGdJIpwlsQtnGkgXkqhpfyDmzkZJdoQ37S0fPHhQgmJyU0OGDDHuS+U7DGBZsWKFpJeihjn5gCzNkiVL1OXLl+V+TCB9Tt8DfcEkQckvZqbff0sr6aH16dSqVSuSFXGiKInDQsBNR83YZPbNMpPn3LlzwV6acC1btpTR2boXXOtpE+elPQsvsLkH4D70d/UQDp2GF1NiRHa6aMAf2Z5Qf9eXly3p36XIk6sbOHCg7IvF8QdRi2RZRWeHUwzWg0S0cHR2mN7+VHqFl5AdjIvsNtVaikxnYm3m4BO+ePECzVLetYK+g2aJqVmSCGdJIpwliXCWeCccHce09MS7DBdjHoJpL3wh8UI4WnVGOeGVI9KAAQPUuHHj1IQJE2QYPQE6nyGkL3ghHGmc9u3bq0ePHsk8iAMHDqgNGzbIJDVm3zx9+lQml5C9QUDtwbvEqXBYGkKw5MWFCxdUw4YNg0/+hOFXiMgCL4z2jDIwOh84FQ5L27p1q5o4cWJwJDtYWq9evdTZs2cjD4yOG2fCUfn3799fjR07NjgSjg4Ne/bsKdOjdKbCBU6Ew3JICO7cuTM4Eh2mAtBouCqyToSjou/evbssqmILdR59AVFGlceJE+FwPbp16xbs2cPAaFc+nhPhqJdwP3KFOVuucCIc4JvlStg43XziRDiGu5pONsvG/PnzjacbxY0T4Ug/EyVEcUUyIaog7V+mhKNXja7Ibdu2qTlz5gRHw9E+G9bKAgQulyRyVscB4jFcYvXq1cGR7CDS8ePHJdJANJc4FQ7oz2XakOlsw+HDh5esfOjK2sC5cDqMmjZtmrxnY/v27RKj+jABxblwgAWR9QiD1VwJs1xamsYL4bAgJhTrScX/BxHCgwcPrMa65QMvhNMWpNc6+j/IppDk1EXbNX5cRUC2IiidwJ6IBl4J9zeRCGdJIpwliXCWJMJZkghnSSKcJYlwlnglXLZwynU2JBOvhHv8+HGw9Sf0jNHzn4RcGZAhybYmE3PKmIvli9V5IxwZEsbCIcyCBQvUsmXLZF3ORYsWqbp168q6vyyM5wtFxcXFP1lU03UqGhgaQb8CWRA9tAEhsUYfkpfAwx0zZoxfdZzOgDBviv4IHiYvX3Jw6XglHKS3npnvPuGdcH8LiXCWpFwNzPubQbMUFW8injloxbCLFKv5JZjDoEj+z1fJDOn0aeUJpcO4Y0JDaRwYVuDDgse+g7Xx7wH5zyUlq0BgdYQ0YQuVlFWIajAuveJsiXB0BiMcfxBl3d+ygF4y4969e2JxSFYinGbfvn3yz3wYcuCjx15IRKBfGrRt21bmlv2HUv8AV+AIUN7u0pAAAAAASUVORK5CYII=" alt="Paris"></div></br><div class="fnt">Your Files Has Been <span class="xsw">Stolen</span> And <span class="xsw">Encrypted!</span></div></hr></br></br></br><div class="vl"><div class="Mrgnlf">All Your Files Are Locked And Important Data Downloaded !</br></br>Your Files Are No Longer Accessible Don't Waste Your Time, Without Our Decryption Program Nobody Can't Help You .</br></br>If Payment Isn't Made After A While We Will Sell OR Publish Some Of Your Data, You Don't Have Much Time!</br></br>Your ID : <span class="spnn">KTKNT</span></br></br>If You Want To Restore Them Email Us : <span class="spnn">[email protected]</span></br></br>If You Do Not Receive A Response Within 24 Hours, Send A Message To Our Second Email : <span class="spnn">[email protected]</span></br></br>To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .</br></br>Every Day The Delay Increases The Price !! The Decryption Price Depends On How Fast You Write To Us Email.</br></br>We Deliver The Decryptor Immediately After Payment , Please Write Your System ID In The Subject Of Your E-mail.</br></br></br></br><div class="dives" ><h3>What Is The Guarantee !</h3></br><div class="Circe1">Before Payment You Can Send Some Files For Decryption Test.</div></br></br><div class="Circe1">If We Do Not Fulfill Our Obligations, No One Does Business With Us , Our Reputation Is Important To Us It's Just Business To Get Benefits.</div></br></br><hr class="new1"></br></br><h3>Attention !</h3></br><div class="Circe1">Do Not Rename,Modify Encrypted Files .</div></br></br><div class="Circe1">Do Not Try To Recover Files With Free Decryptors Or Third-Party Programs And Antivirus Solutions Because </br></br>It May Make Decryption Harder Or Destroy Your Files Forever !</div></br></br><hr class="new1"></br></br><h3>Buy Bitcoin !</h3></br><div class="Circe1"><a href='https://www.kraken.com/learn/buy-bitcoin-btc'>https://www.kraken.com/learn/buy-bitcoin-btc</a></div></br></br><div class="Circe1"><a href='https://www.coinbase.com/how-to-buy/bitcoin'>https://www.coinbase.com/how-to-buy/bitcoin</a></div></div></div></div></body></html>
Emails

Targets

    • Target
      BTCWare.zip
    • Size 562KB
    • SHA256 efa1b4bc26d743edcf4335f89d5366e8233f179f46de081612adc71ee9fe4444
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarestealertrojan

    • UAC bypass

      defense_evasiontrojan

    • Clears Windows event logs

      defense_evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Creates new service(s)

      persistenceexecution

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Enumerates processes with tasklist

      discovery
    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Power Settings

1
T1653

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

1
T1562.001

Indicator Removal

2
T1070

Clear Windows Event Logs

1
T1070.001

File Deletion

1
T1070.004

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Windows Credential Manager

1
T1555.004

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Query Registry

5
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks