Overview

overview

10

Static

static

10

48355bd2a5...a3.exe

windows10-2004-x64

10

48355bd2a5...a3.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 11:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.exe
  • Size 499KB
  • Sample260805-nejamswelf
  • SHA256 48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionmespinozaransomwarespywarestealer

Malware Config

Extracted

Path

  • F:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\Readme.README

Ransom Note
  • Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] [email protected] -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What to tell my boss? A: Protect Your System Amigo.

Signatures

  • Family: Mespinoza Ransomware 2 TTPs

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    ransomwaremespinoza
  • Renames multiple (3638) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.exe
    "C:\Users\Admin\AppData\Local\Temp\48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2648
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:360

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        update.bat
        • Path C:\Users\Admin\AppData\Local\Temp\update.bat
        • Size 339B
        • SHA256 676e435473c9607aac13b64b98af2537be3309746a1c7974fd64234be2be8e1c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Readme.README
        • Path F:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\Readme.README
        • Size 539B
        • SHA256 37aa14fcda86049bd4e6140ee406d92825a262ae518ce6dac603316090f9d9d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download