Overview

overview

10

Static

static

10

2026-08-30...le.exe

windows10-2004-x64

10

2026-08-30...le.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/08/2026, 13:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-30_bacbcda0700df8dd2c9f49fae8fe11d4_elex_sfile.exe
  • Size 296KB
  • Sample260830-p95b2adj3v
  • SHA256 a3d2a45e6cf6832eac4e15bd8dc9650505a0093fb5cce6786bbe26b874e48392
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryrookransomware

Malware Config

Extracted

Path

  • C:\ProgramData\!nissenvelten!HOW_TO_RESTORE.log

  • rook

Ransom Note
  • Hello! We warned you, but you even didn't replied Forced shutdown of devices can lead to the loss of all data. Do not forcibly disconnect storage volumes from hosts, don't interrupt process. Damaged information cannot be recovered. All data is properly protected against unauthorized access by steady encryption technology. We have downloaded essential data of company: - Huge amount of files, including: HR,Financial,Accounting,... - Large amounts of personal records of your employees and residents. - about 1TB (!!!) of data! In case if you refuse to cooperate with us, all essential data will be sold or published at dark marketplace. Full details and proofs will be provided in case of contacting us by following emails. [email protected] [email protected] It's just a business. We can help you to quickly recover all your files. We will explain what kind of vulnerability was used to hack your network. If you will not cooperate with us, you will never know how your network was compromised. We guarantee this will happen again. We can decrypt 2 small files (up to 1MB) for free. Send files by email. Register new email account at secure mail service like mailfence, protonmail to be sure that outgoing email not blocked by spam filter. Don't use gmail! WARNING! Don't report to police. They will suspend financial activity of company and negotiation process. �

Signatures

  • Family: Rook

    Rook is a ransomware which copies from NightSky ransomware.

    ransomwarerook
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Renames multiple (7570) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-30_bacbcda0700df8dd2c9f49fae8fe11d4_elex_sfile.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-30_bacbcda0700df8dd2c9f49fae8fe11d4_elex_sfile.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4524

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        stable.identity_helper.exe.manifest.nissenvelten-sjj3hhut
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\stable.identity_helper.exe.manifest.nissenvelten-sjj3hhut
        • Size 1KB
        • SHA256 a5ec6e53fb16714909422d9b919eaf58ba1d6dcba317823c9ee80d05975cde1f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        !nissenvelten!HOW_TO_RESTORE.log
        • Path C:\ProgramData\!nissenvelten!HOW_TO_RESTORE.log
        • Size 1KB
        • SHA256 72e9a50a52585a25c5529b846cf586946694e46a912a97b526e4a7067ab1d7e6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4524-0-0x0000000000060000-0x00000000000B1000-memory.dmp
        Download