Overview

overview

10

Static

static

3

idkikdikdi...di.exe

windows10-2004-x64

8

idkikdikdi...di.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    37s
  • max time network
    45s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 14:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    idkikdikdikdikdidkdiddi.exe
  • Size 365KB
  • Sample260807-rm2nqsxcmd
  • SHA256 94e8627d2a07a705a2b929bbc60cf9af7a7dd64ddc8212e3f5acb83ac124cc2b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note
  • *** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : PEXWEVZA IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Signatures

  • Disables Task Manager via registry modification
    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Drops desktop.ini file(s) 11 IoCs
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\idkikdikdikdikdidkdiddi.exe
    "C:\Users\Admin\AppData\Local\Temp\idkikdikdikdikdidkdiddi.exe"
    1⤵
    • Creates a file in the Startup directory
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c rd C:\ /s /q @echo off START reg delte hkcr/ .exe START reg delte hkcr/ .dll START reg delte hkcr/ *
      2⤵
      • Executes a command shell one-liner
      PID:1444
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt
    1⤵
    • Modifies registry class
    • Opens file in notepad (likely ransom note)
    PID:3448

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        C4N0F_launch.log
        • Path C:\Users\Admin\AppData\Local\Temp\C4N0F_launch.log
        • Size 1KB
        • SHA256 1e20e8d96b623362bd6df1e295c4dbc0644655a478aad242a5f69ea5807c8fd0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AssertRestart.locked
        • Path C:\Users\Admin\Desktop\AssertRestart.locked
        • Size 14KB
        • SHA256 18ca75ead34e841343a62dec10ed254e2b9cb725003a2028996003fcc276f116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ClosePop.locked
        • Path C:\Users\Admin\Desktop\ClosePop.locked
        • Size 13KB
        • SHA256 87c0ac01cec825b190b05f452c64c317ee219bf101dd0e7c9dfa40e58c807dd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DECRYPT_INSTRUCTIONS.txt
        • Path C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt
        • Size 605B
        • SHA256 1654f5af0b7da605de3e3573e9a92f03e95c83e46cc09463bc7faef137adbb5b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        OptimizeGroup.locked
        • Path C:\Users\Admin\Desktop\OptimizeGroup.locked
        • Size 12KB
        • SHA256 7726ae7bcd0ff48a18c3d9cfd8a3f57c5db14dc2ac455c9817b7261763d243dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProtectNew.locked
        • Path C:\Users\Admin\Desktop\ProtectNew.locked
        • Size 670KB
        • SHA256 9fdbda011340c2a4dbfcf642c1b8a4b31b42db379217267463aaefb9150c386b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SetDisconnect.locked
        • Path C:\Users\Admin\Desktop\SetDisconnect.locked
        • Size 577KB
        • SHA256 a51d923be058f4933bf2872ef62e2c618f3cc2a0213709f193f5dc55da152a1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StepDismount.locked
        • Path C:\Users\Admin\Desktop\StepDismount.locked
        • Size 323KB
        • SHA256 0346538ef18a216546dcd81851246663632679490119348f8c31b45c1ccf7e4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SubmitJoin.locked
        • Path C:\Users\Admin\Desktop\SubmitJoin.locked
        • Size 17KB
        • SHA256 128e8f610cc46e18d0cd4bf740b06ece1abc7fc5be21f0ab2708c43cfa83b24e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SyncBlock.locked
        • Path C:\Users\Admin\Desktop\SyncBlock.locked
        • Size 508KB
        • SHA256 699e22766e83be682b2fc3ee9b7a94e138a10ec596375f47019a57865cee780c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop.locked
        • Path C:\Users\Admin\Desktop\desktop.locked
        • Size 346B
        • SHA256 a499aac43fbfb28cd7a08c9387d89b7dbb151095522943f412539f86a05a69c2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DenyUnregister.locked
        • Path C:\Users\Admin\Documents\DenyUnregister.locked
        • Size 252KB
        • SHA256 558443f1c240661e150f672a5fd25054695778001ade242168d6380f49425a3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismountSend.locked
        • Path C:\Users\Admin\Documents\DismountSend.locked
        • Size 331KB
        • SHA256 3eadb6890fae4b898e7420319478e5dd3f2c7fdab2f8a353ef2f46d0eb7bee50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExpandSearch.locked
        • Path C:\Users\Admin\Documents\ExpandSearch.locked
        • Size 10KB
        • SHA256 bdc45c798115a7c03c340239762cde67b130ee9249e3e2c1b10b259055b21ac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FindInvoke.locked
        • Path C:\Users\Admin\Documents\FindInvoke.locked
        • Size 353KB
        • SHA256 446c2186534bdd99c81ba40c13b24d0e232fffd0191321536e6b10510fe4f491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Outlook Data File - fbutxwreln.locked
        • Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - fbutxwreln.locked
        • Size 265KB
        • SHA256 fa50bb3f7dc46eab3c4ca3da2b31fb0a6dda66818981065485f8362d9a78fb2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WatchClear.locked
        • Path C:\Users\Admin\Documents\WatchClear.locked
        • Size 589KB
        • SHA256 673ca84e7817f36a4341e057f28483abdd5dba2df1b31bbc4417ecff2b432a76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WatchSend.locked
        • Path C:\Users\Admin\Documents\WatchSend.locked
        • Size 387KB
        • SHA256 e896488e213491c14f5438af7b33317e908b8d758b7decad0ee188ceba79bf46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop.locked
        • Path C:\Users\Admin\Documents\desktop.locked
        • Size 466B
        • SHA256 39fed699e16b273f913293da352810d0218e32515aedf51d04acb0892352c66b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CompareRestart.locked
        • Path C:\Users\Admin\Pictures\CompareRestart.locked
        • Size 476KB
        • SHA256 3476e84b2ed954ed73e95ea0524fe8d7535e97cf8090241cfe4f308d416c3614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertToRead.locked
        • Path C:\Users\Admin\Pictures\ConvertToRead.locked
        • Size 1.0MB
        • SHA256 eab400258b0fac171e00c940464b6199efafa73f759e32a08c97b84c57597683
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FlMeOgTq.locked
        • Path C:\Users\Admin\Pictures\FlMeOgTq.locked
        • Size 24KB
        • SHA256 cde441727dc2127265ad83e39cbbd8bd5dcfc6cf1f61b4747dbb8ca0209f21aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PopCopy.locked
        • Path C:\Users\Admin\Pictures\PopCopy.locked
        • Size 1.2MB
        • SHA256 7d0e59cef76be5388f18182056ebaac43056b6d4958d29d2112547504091b758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedoConvertTo.locked
        • Path C:\Users\Admin\Pictures\RedoConvertTo.locked
        • Size 703KB
        • SHA256 c0fb53198ade63232cea67588f9bc98165178258a9d1462b9f177239a4d9b05e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ResumeNew.locked
        • Path C:\Users\Admin\Pictures\ResumeNew.locked
        • Size 1021KB
        • SHA256 ba75ea0bf13b6bf6032af8d1e5d999c41e8c8d5d8d5605dc07e459c0b98d97aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WaitEnter.locked
        • Path C:\Users\Admin\Pictures\WaitEnter.locked
        • Size 1.1MB
        • SHA256 01c1f84a59743549c20b10fdb433fa234f5db7bef767b9ff2d04d7073392c8d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop.locked
        • Path C:\Users\Admin\Pictures\desktop.locked
        • Size 568B
        • SHA256 3d0e92f1fabd5eeb0283d5c79ac09ade32bae553d3826752dd2459ce0e92c393
        • MD5 SHA1 SHA512 TLSH
        Submit Download