Overview

overview

7

Static

static

3

bdef13eced...f2.exe

windows10-2004-x64

7

bdef13eced...f2.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    112s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 05:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bdef13ecedb3b742affe4e24d44ec77afe17bdcf26ff276b3d68a2aac4eb37f2.exe
  • Size 2.0MB
  • Sample260712-gchsrsc17n
  • SHA256 bdef13ecedb3b742affe4e24d44ec77afe17bdcf26ff276b3d68a2aac4eb37f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryransomware

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 26 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\bdef13ecedb3b742affe4e24d44ec77afe17bdcf26ff276b3d68a2aac4eb37f2.exe
    "C:\Users\Admin\AppData\Local\Temp\bdef13ecedb3b742affe4e24d44ec77afe17bdcf26ff276b3d68a2aac4eb37f2.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3848
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a233E.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Users\Admin\AppData\Local\Temp\bdef13ecedb3b742affe4e24d44ec77afe17bdcf26ff276b3d68a2aac4eb37f2.exe
        "C:\Users\Admin\AppData\Local\Temp\bdef13ecedb3b742affe4e24d44ec77afe17bdcf26ff276b3d68a2aac4eb37f2.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4140
        • C:\Users\Admin\AppData\Local\Temp\bdef13ecedb3b742affe4e24d44ec77afe17bdcf26ff276b3d68a2aac4eb37f2.exe
          C:\Users\Admin\AppData\Local\Temp\bdef13ecedb3b742affe4e24d44ec77afe17bdcf26ff276b3d68a2aac4eb37f2.exe -deleter
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3788
          • C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe
            "C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe" {DD19BC0E-827B-48CE-9D16-F7917E8B486C}:{2C876389-1870-4B84-B796-D1117966E7F6}
            5⤵
            • Executes dropped EXE
            PID:1308
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4924
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 928
        3⤵
        • Program crash
        PID:5928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 928
        3⤵
        • Program crash
        PID:5732
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2968 -ip 2968
    1⤵
      PID:4884
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2968 -ip 2968
      1⤵
        PID:3092
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:996
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1524

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            DotNetInstaller.exe
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
            • Size 5KB
            • SHA256 b46671251ff6b22d1357d5485bf6972d305b1ad7bf91b3e82be450c8130c9d1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ISBEW64.exe
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe
            • Size 63KB
            • SHA256 8006ba441ff1122bba3e245b2cfba89528b15031fa6439db838c0f647bdc44dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ctor.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll
            • Size 68KB
            • SHA256 d50ddbd5342af3140eb4b1322421607a00645d5644f255a39f21d2707a939e74
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            iGdi.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll
            • Size 196KB
            • SHA256 eff99ecd79a1995e7ccccb94a8debfe4a5bf4e08c4a82a22b3366a8b22d110e1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            iKernel.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll
            • Size 740KB
            • SHA256 e59d7041586709d8e1f32ef62231e20bfaf246f68b277c32e3232bab3f239f33
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            iscript.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll
            • Size 268KB
            • SHA256 175570abecfeefc0c463b4ce3204d73c1287479d19c9ddce99bde8f99f8b2fb3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            iuser.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll
            • Size 200KB
            • SHA256 1b1e40fcf21eb827e350cbf18f97b27e1273b48b4209cefde205453630dca885
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
            • Size 324KB
            • SHA256 47b4e860b81058cff4d52de76764ec801d0a26549214d80356d05fcbeaa3cc60
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ISB302E.tmp
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\ISB302E.tmp
            • Size 3KB
            • SHA256 54ded8087f02030dbe94d50f25bfa4ec219a5279978046fb1fa6230fe02e4111
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            IsP2FDD.tmp
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP2FDD.tmp
            • Size 118KB
            • SHA256 fe47d890214f6a305dcaa51aaa972876bf07e7a680158a0ba24630fea4c3b8cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Objectps.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll
            • Size 32KB
            • SHA256 c9257a60967c9c4c6c1d641cb7e70841e7466b1f8a473169c14aa898aea07070
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data1.cab
            • Path C:\Program Files (x86)\InstallShield Installation Information\{10DF5555-D134-4C2E-9D32-71BEE4025C0F}\data1.cab
            • Size 341KB
            • SHA256 4d5eda9d55c348d0e08966c71a8e82cb27824bc58e4bf3eb3ccc01fa59e5a2ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            layout.bin
            • Path C:\Program Files (x86)\InstallShield Installation Information\{10DF5555-D134-4C2E-9D32-71BEE4025C0F}\layout.bin
            • Size 474B
            • SHA256 ba99d51a60b5f8afe8da8be96d56c05d4bda6987fe8177d8059e5471a2ae2e21
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            setup.exe
            • Path C:\Program Files (x86)\InstallShield Installation Information\{10DF5555-D134-4C2E-9D32-71BEE4025C0F}\setup.exe
            • Size 118KB
            • SHA256 9f592ba27a79b32d11fafa59facbbebdc9902410e37e2eafa22e677fc33f47e6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            $$a233E.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a233E.bat
            • Size 722B
            • SHA256 410e430a977b3d829b22b1737b0e6a66a077010846d42e608da7fdd973d14bb4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ISPackFiles.ini
            • Path C:\Users\Admin\AppData\Local\Temp\ISPackFiles.ini
            • Size 752B
            • SHA256 399d458c241b3c61a87d05dfbeba577e60cc9258918f1b59e57712eb1fc24ace
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            _isdelet.ini
            • Path C:\Users\Admin\AppData\Local\Temp\_isdelet.ini
            • Size 240B
            • SHA256 16c2bc3b11afe25a9a59e3c37d6d38e5d00006e08ac3de86278545a7cd0dc854
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            bdef13ecedb3b742affe4e24d44ec77afe17bdcf26ff276b3d68a2aac4eb37f2.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\bdef13ecedb3b742affe4e24d44ec77afe17bdcf26ff276b3d68a2aac4eb37f2.exe.exe
            • Size 1.9MB
            • SHA256 e18e79c29f1946dfd7cbed2b8f09e31a0ac860d97601a2a634446cf0a77f70bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data1.hdr
            • Path C:\Users\Admin\AppData\Local\Temp\bye26B8.tmp\Disk1\data1.hdr
            • Size 10KB
            • SHA256 730644108b9e7cebc89e1e25a9b7ec35f8859851745531355dafb1efb720982b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            engine32.cab
            • Path C:\Users\Admin\AppData\Local\Temp\bye26B8.tmp\Disk1\engine32.cab
            • Size 540KB
            • SHA256 771ac22fae6de64ca42c186194977c53f65eb08b4bd166b747ade605345900c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.ibt
            • Path C:\Users\Admin\AppData\Local\Temp\bye26B8.tmp\Disk1\setup.ibt
            • Size 387KB
            • SHA256 611c50b93ba1881871cbc4d59957edc9ca4b50e745a8f6f5c44df7fb85e0a27c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _Setup.dll
            • Path C:\Users\Admin\AppData\Local\Temp\isp2E8C.tmp\_Setup.dll
            • Size 156KB
            • SHA256 0ef51440c705f0d3e0be33ac52ffb5dfc8ba1c73f1aa9db28e91df25d8014649
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.ini
            • Path C:\Users\Admin\AppData\Local\Temp\iss2CE3.tmp\setup.ini
            • Size 436B
            • SHA256 3797d41732b3d808952025129ec80dca46463798ffb5e0a2f49683cbc66ee179
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DIFxData.ini
            • Path C:\Users\Admin\AppData\Local\Temp\{791E2AD1-2A54-4382-A0D5-CD16CAA32311}\{10DF5555-D134-4C2E-9D32-71BEE4025C0F}\DIFxData.ini
            • Size 86B
            • SHA256 1b9fd5c1f18357bd459be20bfcbf47ee18fa0c5d5cc42f6aed2705d5868b65f4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            FontData.ini
            • Path C:\Users\Admin\AppData\Local\Temp\{791E2AD1-2A54-4382-A0D5-CD16CAA32311}\{10DF5555-D134-4C2E-9D32-71BEE4025C0F}\FontData.ini
            • Size 39B
            • SHA256 766ee687d90b0217eb41cb85aca04375bdc24db986a33536631f864b7ce1a08a
            • MD5 SHA1 SHA512
            Submit Download

            _IsRes.dll
            • Path C:\Users\Admin\AppData\Local\Temp\{791E2AD1-2A54-4382-A0D5-CD16CAA32311}\{10DF5555-D134-4C2E-9D32-71BEE4025C0F}\_IsRes.dll
            • Size 536KB
            • SHA256 144d3b3233ef395a9ca022b7f8410cbd1f6544b10e0707d006a646d0382f07a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            isrt.dll
            • Path C:\Users\Admin\AppData\Local\Temp\{791E2AD1-2A54-4382-A0D5-CD16CAA32311}\{10DF5555-D134-4C2E-9D32-71BEE4025C0F}\isrt.dll
            • Size 428KB
            • SHA256 43a2fd93730853bb72e5cd9b924d92aea0358828fa735f31fafbc5c33283b897
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.inx
            • Path C:\Users\Admin\AppData\Local\Temp\{791E2AD1-2A54-4382-A0D5-CD16CAA32311}\{10DF5555-D134-4C2E-9D32-71BEE4025C0F}\setup.inx
            • Size 196KB
            • SHA256 6b6821062fe3f8761a10431c1345d1e28aa35016119fd90a76272512357b4569
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Logo1_.exe
            • Path C:\Windows\Logo1_.exe
            • Size 42KB
            • SHA256 f451eb8d61c55492d9ed96cf478093a1892398ebf98484a6fbe5c172f835ca43
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CMBEdit.dll
            • Path C:\Windows\SysWOW64\CMBEdit.dll
            • Size 388KB
            • SHA256 1ccb4f491f323c0cd45dcf1385136dc972f89c1f511b52af3025a10da97700a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _desktop.ini
            • Path F:\$RECYCLE.BIN\S-1-5-21-1875162379-3804078649-638427191-1000\_desktop.ini
            • Size 9B
            • SHA256 d79ddaff7dba8cb7a3ed7cf29d943dee91a7052601b7969121ce026f17a5c2f3
            • MD5 SHA1 SHA512
            Submit Download

            memory/2968-12-0x0000000000400000-0x000000000044E000-memory.dmp
            Download

            memory/2968-575-0x0000000000400000-0x000000000044E000-memory.dmp
            Download

            memory/3788-217-0x0000000005D40000-0x0000000005E11000-memory.dmp
            Download

            memory/3788-280-0x0000000006890000-0x00000000068A1000-memory.dmp
            Download

            memory/3788-286-0x00000000068B0000-0x00000000068F4000-memory.dmp
            Download

            memory/3788-294-0x0000000006A60000-0x0000000006ACD000-memory.dmp
            Download

            memory/3788-301-0x0000000006BB0000-0x0000000006BE4000-memory.dmp
            Download

            memory/3788-312-0x0000000006F60000-0x0000000006FE8000-memory.dmp
            Download

            memory/3788-73-0x00000000058E0000-0x0000000005933000-memory.dmp
            Download

            memory/3788-128-0x0000000005AF0000-0x0000000005B17000-memory.dmp
            Download

            memory/3788-612-0x0000000005B20000-0x0000000005B87000-memory.dmp
            Download

            memory/3788-123-0x0000000005960000-0x0000000005993000-memory.dmp
            Download

            memory/3848-11-0x0000000000400000-0x000000000044E000-memory.dmp
            Download

            memory/3848-0-0x0000000000400000-0x000000000044E000-memory.dmp
            Download