517ac5506a5488a1193686f66cb57ad3288c2258c510004edb2f361b674526cc

Analysis

user interaction
yes
max time kernel
88s
max time network
36s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ransomware.Unnamed_0.exe
Size 902KB
Sample260724-2lh54sgm21
SHA256 517ac5506a5488a1193686f66cb57ad3288c2258c510004edb2f361b674526cc
MD5 96afc9cdef3c623e0c5420e339c57283
SHA1 ccbdff85419e61987fdb7291f9966a046b0e4b25
SHA512 c839abae06db4e53c1427a1ef4fb20eafe806d41ad3b2f6ddce55d624b93bc5960cc7c90d89b365a880a0a38917609141060b1cfd1287d79b932328479cc1935
SSDEEP 24576:COMJ1lwizdSdyqtnhCJfmuEEQJt7NVpjbWy:TQl3wZCfKXJt7NrjbW
TLSH
T14015F1682CEF592DF073AFB57FDCB8AE4D1ED7331656A84A1040134ACA13D81EE21979
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url	Ransomware.Unnamed_0.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 1604	4716	Ransomware.Unnamed_0.exe	92

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ransomware.Unnamed_0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	Ransomware.Unnamed_0.exe
4716	Ransomware.Unnamed_0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	Ransomware.Unnamed_0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2896	4716	Ransomware.Unnamed_0.exe	89
PID 2896 wrote to memory of 4436	2896	csc.exe	91
PID 4716 wrote to memory of 1604	4716	Ransomware.Unnamed_0.exe	92
PID 4716 wrote to memory of 1604	4716	Ransomware.Unnamed_0.exe	92
PID 4716 wrote to memory of 1604	4716	Ransomware.Unnamed_0.exe	92
PID 4716 wrote to memory of 1604	4716	Ransomware.Unnamed_0.exe	92
PID 4716 wrote to memory of 1604	4716	Ransomware.Unnamed_0.exe	92
PID 4716 wrote to memory of 1604	4716	Ransomware.Unnamed_0.exe	92

C:\Users\Admin\AppData\Local\Temp\Ransomware.Unnamed_0.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware.Unnamed_0.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nwg5ockw\nwg5ockw.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE589.tmp" "c:\Users\Admin\AppData\Local\Temp\nwg5ockw\CSC7262E3B0DAA5469EADAA53DEB68D37C.TMP"
    3⤵
    PID:4436
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESE589.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE589.tmp
Size 1KB
SHA256 2a1d0b243d561112ebc94fc96a674b8e27da34cf458867d658bd0671d11b93ef
MD5 a5d9ec8490d211e619277db901e7dde0
SHA1 04fed9995d2153f5a1ce4d8357e6810255ef2a75
SHA512 b5cf8e20ebe3d2c6ababd9374e75ed2cf33391cd2d52c338343295e6994c0905da76141be61cd3bb57dd3beac42ec83d58d18269eaad2ad7abfc8cb5cc0981f0
TLSH
T12141024583DC871BF17203317DF75719A6B4BE56AEA9439DB484023E1E12784DD836B1
MD5 SHA1 SHA512 TLSH

Submit Download

nwg5ockw.dll

Path C:\Users\Admin\AppData\Local\Temp\nwg5ockw\nwg5ockw.dll
Size 15KB
SHA256 51c898f72554c4102f940629eaef656f2cb7ad3fe1c0502b1a04c89f177286af
MD5 cfd3d16d1d66b376165bd86dfc0ea08e
SHA1 035259bf85144513c02e29a5c4aa8442bab75927
SHA512 ecb8949d45f542a31a7021c6c3efb4bea5a85634ced6c37d13e3b2a2e6d54651cfd782174132a24100176c52d789501bd8ba06e4726aa4de5159bbeced485f9e
SSDEEP 384:fHjDIPPSu8XH5mvjJjTbkSDHlSASRwRy21jH:gQm9PlSA+MjH
TLSH
T16762D805BBDB035CDE5E0634EC9743204F7061E79DE2A78579D289BCAB577908893EE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nwg5ockw.pdb

Path C:\Users\Admin\AppData\Local\Temp\nwg5ockw\nwg5ockw.pdb
Size 49KB
SHA256 e2caac53902f3ba68af55e5220c58ccc6ccf07ec06c2d5a08803e3ddfb617ce7
MD5 f423f365706fded0fd555cf12a23444e
SHA1 19c41e9f3d3eacf7a16bf9d067573c3aef402494
SHA512 0cbcb0648ffa7ad2cd4386962971a8f3c9aaff01360b1ada9574432f650625edeb643fed59d5ddd4a4a4402d074bd47a5f89275c878f4bd714a774e777f89fa4
SSDEEP 384:pdf5lwARcaUTiDeJR8HxC5eX6BcCdWzfsAOf1yBhN57wS6WUNFTh2td99OA:pbPcaUTiSqhadWfLOf1yBf57yWUIf
TLSH
T111331006BBC1CA33C466873C55AB5F1D8238EC89AB93A71F4359757C3DB335A2C81298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC7262E3B0DAA5469EADAA53DEB68D37C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nwg5ockw\CSC7262E3B0DAA5469EADAA53DEB68D37C.TMP
Size 1KB
SHA256 f7dee448bcfa4025f7e2826cbdc1ede9c2f369238034f7fbb316b471b573f537
MD5 7f187e29c969b1c4d38aca5ab348c5ba
SHA1 f9e1813c8b1bba1c4095e1df3e074476289cdf86
SHA512 970ba4aec068463ab9d2cd24adfe510442a108985955257e868f84c1cc5b9a2c8df5688e9e882260331d91d53931c24aef074156eddb5afccdede241dc010ec8
TLSH
T19B21AB85A3E8820EF1B347707EF2D36391A8BE668D7943EC3488136F2F1594185836F1
MD5 SHA1 SHA512 TLSH

Submit Download

nwg5ockw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nwg5ockw\nwg5ockw.0.cs
Size 29KB
SHA256 8685fc1ef0ff239f59289b26d9aa7134998f4cc4a15b22c9a8922c071bb32639
MD5 be0c48fc5057a467514eec58f1b1264b
SHA1 6d656174c6c9ab1e4c3d75cc9270a2aa4079183b
SHA512 157df2d4ef94906418ea32be5feedc28aac61787033e7473f0eab8e22d32a2a83ddbb5c43c16b0d5f83c8c27f167e1fcf2967df35bdbafca75327dc35ed443f1
SSDEEP 384:N6MtTqr1lICbMjhXKgbadoSXPtCFF8bKMNTPCc7EGfUmWGiLXc2:5tTJOahsdPtC6NTP7SmWB9
TLSH
T11DD2C6042B05CDB464AE21809092D493FE37AE634FBDB459F19F45ED0BD3CAD46B98B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nwg5ockw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nwg5ockw\nwg5ockw.cmdline
Size 248B
SHA256 94b3d1626f7b771b69371fa0ab9a346e040fa62e82c9184719be202ed6fe6ae7
MD5 b09fbc1925e306e87f66645b55a62839
SHA1 37c36e657535ca649fd095a206d270f998312ac7
SHA512 cbf6429aa4e1ac413dd8f46bd5f806728395a1fd0689bc5c42524c98ced4ff11d47707835491c062d496649611ce52d85fb6c50d1a9c819b47d240e9aba1f600
TLSH
T1AFD05B1D86E3DA189D98104741E2A1AC43318D6639515A154F60414E12779156FDAF5A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1604-25-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4716-0-0x0000000074E82000-0x0000000074E83000-memory.dmp

Download

memory/4716-2-0x0000000074E70000-0x000000007562C000-memory.dmp

Download

memory/4716-1-0x00000000007A0000-0x0000000000888000-memory.dmp

Download

memory/4716-17-0x0000000002BE0000-0x0000000002BEA000-memory.dmp

Download

memory/4716-18-0x0000000005250000-0x00000000052E2000-memory.dmp

Download

memory/4716-19-0x0000000005880000-0x0000000005956000-memory.dmp

Download

memory/4716-20-0x00000000053F0000-0x00000000053FC000-memory.dmp

Download

memory/4716-22-0x00000000055D0000-0x0000000005699000-memory.dmp

Download

memory/4716-23-0x0000000005950000-0x00000000059EC000-memory.dmp

Download

memory/4716-27-0x0000000074E70000-0x000000007562C000-memory.dmp

Download