Overview

overview

10

Static

static

10

PROOFS OF ...S .exe

windows10-2004-x64

10

PROOFS OF ...S .exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    61s
  • max time network
    63s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/08/2026, 11:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PROOFS OF THEIR INTENSIONS .exe
  • Size 149KB
  • Sample260811-nwp5hsdn3x
  • SHA256 1a834c5c04161675b676d9d11ee4fc9e96b9b8095eb8d305d67c255be1cdbba2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\A7dQaHjzN.README.txt

Ransom Note
  • ~~~ IF YOU WANT TO BRING YOUR PROJECT BACK TO NORMAL FUNCTIONALITY WITH YOUR BACKUP AND DECRYPYION FILE YOU REALLY NEED TO PAY SOME $$$$ ! AND AFTER SUCCESSFUL PAYMENT YOU WILL RECEIVE YOUR READY BACKUP AND DECRYPTION FILE FOR RESTORE YOUR NORMAL WORK ! BITCOIN WALLET - bc1qg753w3v5hkhlygfrlst424h23x964qav3sr9f9 WAITING FOR SUCCESSFULL PAYMENTS !~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak.
URLs

  • http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

  • http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

  • http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

  • http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

  • http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

  • http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

  • http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

  • http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

  • http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

  • http://lockbitapt.uz

  • http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

  • http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

  • http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

  • http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

  • http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

  • http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly

  • http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly

  • http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly

  • http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

Signatures

  • Renames multiple (1088) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PROOFS OF THEIR INTENSIONS .exe
    "C:\Users\Admin\AppData\Local\Temp\PROOFS OF THEIR INTENSIONS .exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:5724
    • C:\ProgramData\E693.tmp
      "C:\ProgramData\E693.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4900
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E693.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5104
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5704
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:5360
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:6032
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{4B41D014-6ACB-45B3-9E1F-5C9CEA459B54}.xps" 134309225301940000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:4968

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AAAAAAAAAAA
          • Path C:\$Recycle.Bin\S-1-5-21-1074038928-2032447174-945360078-1000\AAAAAAAAAAA
          • Size 129B
          • SHA256 6a7a4c05da729a1ceaffd0410b1f9a1daee981ec687238c685dbc5d0a1ef844b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          A7dQaHjzN.README.txt
          • Path C:\A7dQaHjzN.README.txt
          • Size 3KB
          • SHA256 d06e3ff51bdb62625c3c370f6403a33eedf19b546824f7a9c0962133eaab4557
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          E693.tmp
          • Path C:\ProgramData\E693.tmp
          • Size 14KB
          • SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartUnifiedTileModelCache.dat
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
          • Size 19KB
          • SHA256 cb397116ff4d24dd9247f7ce6de79b17b7ab81b4ce97cabc27b5b7947720c43d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartUnifiedTileModelCache.dat
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
          • Size 24KB
          • SHA256 dd38b6bca5b059917cdc2cb3cba737a83e340f0f274dfd08b65db012021e1aa0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ~tartUnifiedTileModelCache.tmp
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\~tartUnifiedTileModelCache.tmp
          • Size 23KB
          • SHA256 572a1b0568a55ce34342f78a0abdf43cb0f5b029e3809836f03db0ba12aa093b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
          • Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
          • Size 149KB
          • SHA256 210855e8c92f07b63a37c321d1808ab0ba4d4aed2c280ceb2f25785a5a4594cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Open Notebook.onetoc2
          • Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
          • Size 4KB
          • SHA256 368eac1a98633a06b7332e16d8857da9323765a6dc4a5db5c5114ae131491e20
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DDDDDDDDDDD
          • Path F:\$RECYCLE.BIN\S-1-5-21-1074038928-2032447174-945360078-1000\DDDDDDDDDDD
          • Size 129B
          • SHA256 d37806deb32394d1b24eca5bbe70c7a66d3b561946b4958011200c2ddbd85e06
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2792-3863-0x0000000002F20000-0x0000000002F30000-memory.dmp
          Download

          memory/2792-2-0x0000000002F20000-0x0000000002F30000-memory.dmp
          Download

          memory/2792-3864-0x0000000002F20000-0x0000000002F30000-memory.dmp
          Download

          memory/2792-3865-0x0000000002F20000-0x0000000002F30000-memory.dmp
          Download

          memory/2792-0-0x0000000002F20000-0x0000000002F30000-memory.dmp
          Download

          memory/2792-1-0x0000000002F20000-0x0000000002F30000-memory.dmp
          Download

          memory/4968-3876-0x00007FFBE2A50000-0x00007FFBE2A60000-memory.dmp
          Download

          memory/4968-3877-0x00007FFBE2A50000-0x00007FFBE2A60000-memory.dmp
          Download

          memory/4968-3878-0x00007FFBE2A50000-0x00007FFBE2A60000-memory.dmp
          Download

          memory/4968-3875-0x00007FFBE2A50000-0x00007FFBE2A60000-memory.dmp
          Download

          memory/4968-3874-0x00007FFBE2A50000-0x00007FFBE2A60000-memory.dmp
          Download

          memory/4968-3883-0x00007FFBE09A0000-0x00007FFBE09B0000-memory.dmp
          Download

          memory/4968-3904-0x00007FFBE09A0000-0x00007FFBE09B0000-memory.dmp
          Download