ceb2680f70c5053932c2a205ad165a20cec6942cf3eea952dcff98acc382ef8a

Analysis

user interaction
yes
max time kernel
138s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CVRDIE.exe
Size 1.3MB
Sample260818-dsakjsfb46
SHA256 ceb2680f70c5053932c2a205ad165a20cec6942cf3eea952dcff98acc382ef8a
MD5 9ff63861ea959d8a9265a78664a3ab76
SHA1 a539fc67142527f23a9c5b6631b1bd0046226ce2
SHA512 37d9ad912c0bfd7c9ed8812f7d058d958981e8011405dd65043c2e7794fd438be2b807ddd6fe7c68636195ca4f642d955f4a4226c4f7d149a52a5c5e44959331
SSDEEP 24576:X4lavt0LkLL9IMixoEgea1ywiIzdFXU8T17vKDHq9MmCS:ykwkn9IMHea11U44aPCS
TLSH
T17B55D04373EE83A5C3B25173BA25BB01AE7B7C2506A5F59B2FD4093DF920122521E673
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1244	WScript.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\Wallpaper	CVRDIE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	CVRDIE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CVRDIE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop	CVRDIE.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	CVRDIE.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2	CVRDIE.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\CIMV2	CVRDIE.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\FRPTRMXS\root\cimv2	CVRDIE.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	CVRDIE.exe
4880	CVRDIE.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4880	CVRDIE.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1244	4880	CVRDIE.exe	91

C:\Users\Admin\AppData\Local\Temp\CVRDIE.exe
"C:\Users\Admin\AppData\Local\Temp\CVRDIE.exe"
1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ms.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

Gbr.jpg

Path C:\Users\Admin\AppData\Local\Temp\Gbr.jpg
Size 47KB
SHA256 75b4f938ef9f6f16dfbe0b51059a9e2eec0b6b0181da858d1eb583c7bade1b7c
MD5 ce94aa7597e75ae67b186e69d007aea1
SHA1 219528434a7276b1928ef3c0a62c18edd43b9e10
SHA512 884dee69447ee765d9329055d99ac740d365a51cce0b11dc86b158ea3c87618a6f8122d394b073a2fc060c6bda07a8f89c4ac4410cb7fcb2d67f44d31e22c15a
SSDEEP 384:LksT+P6ZNRlyT0G7EXf4B6ZfWqFSRd/4jdDDgb1:L1Qz0PlZVSRdedDDgb1
TLSH
T1232392039D194B97A52897F8BD470EBC6F1D2B5CE8862BFF01321ED739202625C5E46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gbr.jpg

Path C:\Users\Admin\AppData\Local\Temp\Gbr.jpg
Size 49KB
SHA256 8592b174445f374f8e1bc97bdce1069093d773f4703d6e95bec63a49d06ddb26
MD5 88cab3a7f978c6beb2a35fe21c72531e
SHA1 026337415490662d8d9f399918c81ea798ff59c5
SHA512 32e5a8433ff6d4eb547be92d05a361020476d003ff78b7680b26e4636fa6dac9bc96498385d04c7be02d98df422b0bf15d11159d5c970244092b81e0b67d45ce
SSDEEP 768:LcruooSRHGJ4DtT+LadOUsr9KosZWxMJBkfaC:LxSRmJ4DtT+L6OUsr9AWxGkZ
TLSH
T1C333B0078D089B87A56857F8BD474EAD2F0A3B5DE9513AFF51265EDB3D301121C8E02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.vbs

Path C:\Users\Admin\AppData\Local\Temp\ms.vbs
Size 13B
SHA256 edcaac5f3b491469418a6ec95b05b138e2b14b3216818b69e77fa566a662ba1d
MD5 0522e95778817010e617ea0c8a7e77ab
SHA1 fa4a3d2d3891c16879ec8cf0bc993ca51215a894
SHA512 34f0f758f29c65b3e0da014099f209c57dcf8bd43dd5122020a2287ef205799a29a4399c01eeb3b3e4041df6ed01c9a379cea6faedee0204048d06ebe38b000e
MD5 SHA1 SHA512

Submit Download