5ff4c2c395f54fa249c32c8c46c99ccf7e91d56311cf40b8390521246eb38174

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_ef2a38d185b1a0f93b88fc768043071a_dosia_frostygoop_ghostlocker_glassworm_hive_knight_luca-.exe
Size 5.0MB
Sample260811-3pp89svaje
SHA256 5ff4c2c395f54fa249c32c8c46c99ccf7e91d56311cf40b8390521246eb38174
MD5 ef2a38d185b1a0f93b88fc768043071a
SHA1 0141ce4ae3e11be503b0a3bf1f8562ad6be9db05
SHA512 98d8be2b67e2695f47f227b6a4c1ac0277f4e0b9accf290b6f9b4a625ff51ae8c17e7cc941469ab0e5a443b64008545d3dd00c19febb842a0e608f5ee61d762a
SSDEEP 49152:l05nkhoygC9G4FYkogI0yKM7Bjy5EZj7YDBi2ENoiSzM0KFFg4yrXGvnLb1yKwnO:l2yokYkoBOEdED/rzM1FaXknL/oULr9B
TLSH
T17F368D47FCA049A9C4AAA331C9A792927B71BC084B3263D73A50B7783F767D45DB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2780	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5084	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	6056	vssvc.exe
Token: SeRestorePrivilege	6056	vssvc.exe
Token: SeAuditPrivilege	6056	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 2780	4900	2026-08-11_ef2a38d185b1a0f93b88fc768043071a_dosia_frostygoop_ghostlocker_glassworm_hive_knight_luca-.exe	90
PID 2780 wrote to memory of 5084	2780	cmd.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-11_ef2a38d185b1a0f93b88fc768043071a_dosia_frostygoop_ghostlocker_glassworm_hive_knight_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_ef2a38d185b1a0f93b88fc768043071a_dosia_frostygoop_ghostlocker_glassworm_hive_knight_luca-.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\system32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5084

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads