Overview

overview

10

Static

static

10

2026-07-17...os.exe

windows10-2004-x64

10

2026-07-17...os.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-17_7cb1b7cc0b55845c29a9ca8a3a497a04_amadey_blackenergy_elex_hellokitty_lockbit_remcos
  • Size 157KB
  • Sample260717-freh8abt6l
  • SHA256 24d62b24ced3b0a185dc8b973c6856cdd9e31b7d8a37462a3f85ffd586f289e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lockbitcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarestealer

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: eZFHH5SakpQ1O1DD5X7pMly4pZkTE3N9vKCJ2aWyUxYP/wGIvBndJmBj8JNiMtAI re0TqzcRUtvbU4HFK77qNFNfjK9sUg0XPD5a7hlD8/NytrySi8AFZsuji1VUMqPa dHmpHToC/qwXaW8N+Ktph75aRzDJgwPc/NeL9FlBHw+hCQ7EcMyRh1pIGT6VZevx KjVxjRXSFdUooqSlUON/NfGTZHJ+X0LfhyqBseJ4rws1JxJA4blNUvqmjJEJRvfc x0T44WRg1Sa370hccq24L0iYxNT3XduiVryRhDsUSgAh2p29cmUVlfa8h6V/ukIR fePUc+eT2p17dNcny+1B+zgY2bXrQYX8D1Xf3FdkiRWBnmff1Sz5foP55qnQIeBK SOQbp8vPIh7LTkO/0YdSMv5Xa6nMrqtaW8tnTkurjGPipUHurpDNTYbY4RMmp9la STH2+vDRZ4meaNd+7h0YSNaarX8WhF/DwHt8PBpfuLeU8zTTtscHztpgg2algydu 9jvz7MPXmeMe5cBFuSwr8X1dLt40iFXqS0awsDpebUOquOoM26p4g06pjGZu49CE mo0mMu5fauk67BKHln6LBDWcnXS7obT30lSOFVvfD2CdmHifGOYdUw8rq0+PyZ9y qXbff8aCBaSJuxtQQrHnvbyrlNsAN1EFYJdtLsp1Dv8fCZczEZBkM3V+DdD7m139 GrAKgmUhwlCCByau2ByKS68DZVaGTzxtdmAWTzFZEWHT6oR6X+CHqBVxps6Uxfmy YhOkGryoPyduH2zOvHStwOykyNnlEXIryHDHRYy/xteacjzjDg+MsmH/KAtncjmE /fINDLSQ15Ew7CmdOTgQnCs3dWU0+vBUXypQIWmVX8SC9/xhHpcURW9p26OzMA7e a3lUNszpajkVE7rjp/TAdq1c//l65Mbi88MXL7ogCK6rvkhwP7V9CWeZYKk/xb7a wsa4zZBmuMHRz7alQ4NkSnTigqI4McSFHMcQfPWZF2m810HL7WbJvaVZrqo1SUBV BrG42ImpYHwyMudtRzRtmR/X9IqbMuhwMWZbNNQ5XapWVoQTcThMD74ZbseFUqGU o9bY7PL3e3sUfyrGwws6edmf+P5x01uH8WIqXtjpiyFukCt6cPzK4pXzoaLQa0eG 4P8ZKUHPBP5M5uxNBU+1EA9KGwI+Uc4JdDFqJoAkzZJq9ZMXKPnTJOphOAG7+nS2 Pq/e1rCHjuWET0kl3Qqz+Zq2JcFNE4vXYN+AGyOGR4Gb2So1Bcw7kZxHFU5u90TJ F2BzNxx48aXr0nqzQIqrODJ7QfDD6JCJuwbmDtl6kVDJvZ5SH5il9jNTXJ3UqwoY GUPKDprCedyJkTJLPy2mnUHONtSyg6bQYWCc0/3nXI0t2ArX14DfDPgqInmBO3fF rXwXCIbRGY3kAPFXEyFACQi+K8mNyBnWtTFrEDy0X+xC60eVXFvq2rjosXHyLjeS kr1ZL1nDCs0FY1NC3dl/RHnJR/wMN5CaOc75lwbwpj062Hkz9l5k8gGVJlXDygLC CR09RNHdZuBAeD0QpKAXBfK73gsM6ATx5qjYtTIVGQt2tj2wk2EQ/js/DZ8nQKCR 5uZLBReykryTjhFtjr9KQGrUiT5CV7ET5MigEqZbpzHc8ES1sEguRR3kAr3xLMT0 bxt/SU1PwQ9zCYX2HxX8B5cyo1sGX6Z5EnjezOWxeKs=

Extracted

Path

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: fwtuPiMIpDnRB5ZcE9Dveo6BAJWON2a0hdSeNFq76VoXEbSNhYIliUIad+jfmMrr Vi9DdfIoxrVc6SHSZy/gWe7vvZTZVU8+Njo78s6tWSCCjRBPKynQ2JtCtL9Z/9mx BwhPShV085s/7/GSqsd8Xent3A3FjHnyOhJdgcH2lII4K0soh1vGoxZaGj5rphkS 0dLcW3cmcOgrkag6h25satgdnRs5k02y+CsRD4R/zOaDP7+1cfgcXHWmmyQCsy7y ua+iMYYD1f6cTYfHtN3O7aDEjC94SDsaiPvhLfov2mnG2hyAlfRdqkyj0wVjef+w 2YbkP7CQtZTsjhKSUK8yzlesVMIEGnwZDdYrfeQq/2eRbR70EjioikIFXSTtsPxD L5duf2YpXTBSKVV1Gg2c+YhhmhzCvi0Ue/BA5sSKJxL7GtbXBZRA4jTn1CTxgRry TdA2tnWzRqsTp9dp/yiQfh1uSr3bjKkvDSq7UlDxzUMmdBoX2fmJH4Af1FCqCHPm GSk4Fu0HKuxDXZeQg4wOjXJUh4UegDDex0XNz1m+TH1UMyoLs9vMNXUfAXQzIvCc +ie2LMLLMuE6dxmAUfeajVzGimPr30vhbBVFmrmXh9Y1x3i2iK+w06LOmqr+qFFB esYg5Dspq3spU5vnuDxo3PepEJlp3lJAFT9D+gxlqeA+RNNr//FnZAdMi2+upjsA lcI8N10CZiOlcMA3pdpTuct0PZnqTivrWB9ivue2TU0DXIw5uCqWNGi0L34KetXd 7dna/XJWvvLo+9n7bay2DHXU+040R+PcqYnhUUEcGY1N/72U1JDzFf68IRwFyrZS lG7hrF8JokXnSzAZDpxikpb/Ffk22lPgmp5BBDYjg0i9JapDaQsUpj564nYIRKsr Z8tOxhCVoIjWqLo3zNPM4h//yQDvjNI9lR7Luy4AAFF9vMJwZ5nHjs0zdjPghD4I bk/77ci61ZBbHtU6aPVWZBHPRSazWYFDzSbKKflGRqY4zM61riWpUM3zAq9wuJA8 B7wWUC8iBFPrWScjEjtGHGNRHY+tVVKxRcH+eH4KY43qvJMZB/hfKNst6dqNFeye uXpbwk5LO1e/v4OmJAC0JBrp672cWoQr4QRIoWqc7uiB+XmlVOwrvzJm65NVbmO0 /41Cm6Hm6IKfp6U3d2VZz6ordpjZX4nvl7JFr+G6LFE9bRUnfaczeQX3Oxl8DVOk qIgz+UHugPkJn2DNgWMHrjvYkxNzxsIpXlWsxYUjEH4YdPLriRbzuaCJgXE08tLY HowMIK9ofsPqpDz+GVtErFglDaXK9BKhGiYrUWwNsm17dq65zC7KvP4jED4gR6Np f9C/UneGVlaQBUwmt66OuHGyRXuwthbIWA1h2PG0b2u/xfAUf4z5zcHcLbRB31JR V2s+isnPhrjf/Gh/avzAJ9YZ+UQeSueGZ2Ln/Z09VkpIbnDLBR8xhLt+yMKG/qZQ V/eWAbo92fVcPeaHkmwj0eHblerQUJW7m1Md6H9il7CuvzaUaukfFrXKkTHlv/DU ve3CHi/slBMmRbUX42f2259JpWsgBXdLGlu4vVjp1Hv2LmCx4zlRstUJB5QwDvqM UujPLITWzmMd6w/0nCFbTi6aj+8uWc9pTy5BJuTf6t3rNaKUAKPwVuNCawpPZx9l hExUVixojLEncWnINGeMDtAlolaah0/XE8geKgyHiOY=

Targets

    • Target
      2026-07-17_7cb1b7cc0b55845c29a9ca8a3a497a04_amadey_blackenergy_elex_hellokitty_lockbit_remcos
    • Size 157KB
    • SHA256 24d62b24ced3b0a185dc8b973c6856cdd9e31b7d8a37462a3f85ffd586f289e3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoveryevasionexecutionlockbitimpactpersistenceransomwarestealer

    • Family: Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (6681) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Windows Credential Manager

1
T1555.004

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

Remote System Discovery

1
T1018

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

4
T1490

Tasks