Overview

overview

10

Static

static

3

idkikdikdi...di.exe

windows10-2004-x64

10

idkikdikdi...di.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    48s
  • max time network
    72s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 09:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    idkikdikdikdikdidkdiddi.exe
  • Size 358KB
  • Sample260802-lrkccsgc86
  • SHA256 da6d01ded185ef0f7ad6cc99815abd3dca19c14bb6e2f316d60b375b543cdd8d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note
  • *** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : DLAWBTBF IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Signatures

  • Disables Task Manager via registry modification
    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 11 IoCs
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\idkikdikdikdikdidkdiddi.exe
    "C:\Users\Admin\AppData\Local\Temp\idkikdikdikdikdidkdiddi.exe"
    1⤵
    • Creates a file in the Startup directory
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3912
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c rd C:\ /s /q
      2⤵
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Executes a command shell one-liner
      PID:4240

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        C4N0F_launch.log
        • Path C:\Users\Admin\AppData\Local\Temp\C4N0F_launch.log
        • Size 1KB
        • SHA256 25adf750abb9fd9353fb8991540483164145c5742d053702a1157a98c2cd9aa8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C4N0F_~1.LOG
        • Path C:\Users\Admin\AppData\Local\Temp\C4N0F_~1.LOG
        • Size 1KB
        • SHA256 4590b636bc19a29476890c17f2f274f4fece30fcab9dc68a239e45d6cc4ac7c5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RANSOM~1.BMP
        • Path C:\Users\Admin\AppData\Local\Temp\RANSOM~1.BMP
        • Size 5.9MB
        • SHA256 1cab03d220a0eb77308d8bf486454b1c89ee93542c37deb6a7e1c69e61bd0fbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CheckpointStop.locked
        • Path C:\Users\Admin\Desktop\CheckpointStop.locked
        • Size 137KB
        • SHA256 dc57176067afe31dd31d222ad4da18beabc05d75dee262c0d280176f3384c89b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DECRYPT_INSTRUCTIONS.txt
        • Path C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt
        • Size 605B
        • SHA256 d1c82527db60bf295320fd06d0f5d6db9ca0f41d6ae86a856c66d11ae9ead210
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DismountUpdate.locked
        • Path C:\Users\Admin\Desktop\DismountUpdate.locked
        • Size 169KB
        • SHA256 a45f6bd59e806bf8753707296a5a8110a3a611d9f93c42ae63799ae0ad513743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NewConnect.locked
        • Path C:\Users\Admin\Desktop\NewConnect.locked
        • Size 15KB
        • SHA256 4df1d5902b7e33c09a4373108f5e3ab1738e15970efd93a3fe80c66f1b201603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop.locked
        • Path C:\Users\Admin\Desktop\desktop.locked
        • Size 346B
        • SHA256 a499aac43fbfb28cd7a08c9387d89b7dbb151095522943f412539f86a05a69c2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CloseRedo.locked
        • Path C:\Users\Admin\Documents\CloseRedo.locked
        • Size 430KB
        • SHA256 9f5f47f3459cc6c3321c42597c7976d5628566aadb2e9824abb3bc2be5063e47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CompleteInitialize.locked
        • Path C:\Users\Admin\Documents\CompleteInitialize.locked
        • Size 380KB
        • SHA256 82086c25231cabc740047637a9a7a9a8f3e6de787ad7f138664a2ff90b993ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConfirmExpand.locked
        • Path C:\Users\Admin\Documents\ConfirmExpand.locked
        • Size 250KB
        • SHA256 15fa75ab801ab3441c832260e887c596f302b560d69f785bdace01fc34de4303
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ImportSplit.locked
        • Path C:\Users\Admin\Documents\ImportSplit.locked
        • Size 12KB
        • SHA256 0e7c472c28b71e92875f4d5e09a30dd8aa7efc84165e8e2113793eb404d4c355
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Outlook Data File - jwlmkizfdc.locked
        • Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - jwlmkizfdc.locked
        • Size 265KB
        • SHA256 bf815072a625cda24e239c03f678931a7ccd5a48831aefd15378754f26618a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PingRepair.locked
        • Path C:\Users\Admin\Documents\PingRepair.locked
        • Size 410KB
        • SHA256 469990bccb559160106d0efe5942ed6fef4f884f94b38eeab73faf7aa2b7aa40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RestoreRevoke.locked
        • Path C:\Users\Admin\Documents\RestoreRevoke.locked
        • Size 10KB
        • SHA256 46b44e9452188861f8598144f0b50a9441b36f1702cd8e656d1b966777f4613e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SetStart.locked
        • Path C:\Users\Admin\Documents\SetStart.locked
        • Size 160KB
        • SHA256 b9176592941ec21b9ceb1c46cfce9afccbfa939e3ecbe46461eb7234074796ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UnpublishFind.locked
        • Path C:\Users\Admin\Documents\UnpublishFind.locked
        • Size 220KB
        • SHA256 c8bd5d349b8676095f0e6f6338f123d6a157fd4aeb3b8fb2d406bee2c2598a9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop.locked
        • Path C:\Users\Admin\Documents\desktop.locked
        • Size 466B
        • SHA256 39fed699e16b273f913293da352810d0218e32515aedf51d04acb0892352c66b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ConfirmRestore.locked
        • Path C:\Users\Admin\Pictures\ConfirmRestore.locked
        • Size 635KB
        • SHA256 04802b48e6f719a8168ef4534e225558b8c1ac44ba6560f8c48e7b89b76f86de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CopySkip.locked
        • Path C:\Users\Admin\Pictures\CopySkip.locked
        • Size 341KB
        • SHA256 ee02fa006a6be5bb96b6418408f320a4c9904079294dbee3fe0bfd2c15145b47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LockSync.locked
        • Path C:\Users\Admin\Pictures\LockSync.locked
        • Size 515KB
        • SHA256 117b746d05fb0cf649d4001a6b9477dff03b568c9357d2b52279c09755d43d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSxPbdqLdH.locked
        • Path C:\Users\Admin\Pictures\MSxPbdqLdH.locked
        • Size 24KB
        • SHA256 06ab9be9e48822a20ad389e770a7ae07c9adb5b3bb334577d6472f53153fcfa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RegisterCheckpoint.locked
        • Path C:\Users\Admin\Pictures\RegisterCheckpoint.locked
        • Size 922KB
        • SHA256 c0fa85cca76443785d3ed56bc165e5414e201428d878fdb01e9c71366749bcd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UnlockTest.locked
        • Path C:\Users\Admin\Pictures\UnlockTest.locked
        • Size 287KB
        • SHA256 6db73a2f4bebcdbf2afd2aaf39413c14a001cf89f60daa77f4e4c3bc2a994812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop.locked
        • Path C:\Users\Admin\Pictures\desktop.locked
        • Size 568B
        • SHA256 3d0e92f1fabd5eeb0283d5c79ac09ade32bae553d3826752dd2459ce0e92c393
        • MD5 SHA1 SHA512 TLSH
        Submit Download