Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/09/2026, 15:01
General
- Target RansomDesktop-v8.exe
- Size 2.6MB
- Sample260903-sd63jazbna
- SHA256 456b42acf9d406bc9ae985ac81928c678d2850c7e2c4bd3c0dfaf3193b6d069f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 31 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomDesktop-v8.exe"C:\Users\Admin\AppData\Local\Temp\RansomDesktop-v8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnAAoAJABwAD0AJABlAG4AdgA6AFIAQQBOAFMATwBNAF8AUwBFAEwARgAKACQAYgA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACQAcAApAAoAJABsAD0AWwBCAGkAdABDAG8AbgB2AGUAcgB0AGUAcgBdADoAOgBUAG8ASQBuAHQANgA0ACgAJABiACwAJABiAC4ATABlAG4AZwB0AGgALQA4ACkACgAkAHoAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAkAGwACgBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABiACwAJABiAC4ATABlAG4AZwB0AGgALQA4AC0AJABsACwAJAB6ACwAMAAsACQAbAApAAoAJABkAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAIAAnAFIAYQBuAHMAbwBtAEQAZQBzAGsAdABvAHAAVgA4ACcACgBbAEkATwAuAEQAaQByAGUAYwB0AG8AcgB5AF0AOgA6AEMAcgBlAGEAdABlAEQAaQByAGUAYwB0AG8AcgB5ACgAJABkACkAfABPAHUAdAAtAE4AdQBsAGwACgAkAGYAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAZAAgACcAcABhAHkAbABvAGEAZAAuAHoAaQBwACcACgBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZgAsACQAegApAAoARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGYAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAJABkACAALQBGAG8AcgBjAGUACgAkAHMAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAZAAgACcAUgBhAG4AcwBvAG0ARABlAHMAawB0AG8AcAAuAHAAcwAxACcACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgAEAAKAAnAC0ATgBvAEwAbwBnAG8AJwAsACcALQBOAG8AUAByAG8AZgBpAGwAZQAnACwAJwAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACcALAAnAEIAeQBwAGEAcwBzACcALAAnAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACcALAAnAEgAaQBkAGQAZQBuACcALAAnAC0ARgBpAGwAZQAnACwAKAAnACIAJwArACQAcwArACcAIgAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4ACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAZgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\RansomDesktopV8\RansomDesktop.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dujcf3kw\dujcf3kw.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES84B7.tmp" "c:\Users\Admin\AppData\Local\Temp\dujcf3kw\CSCDD9BA38228594684B977F64F64571E1E.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
RansomDesktop.ps1
gold.png
ransom_appear.mp3
ransom_attack.png
ransom_attack_audio.mp3
ransom_attack_end.mp3
ransom_crucifix.png
ransom_idle.png
ransom_thank_you.mp3
ransom_theme.mp3
stop.png
RES84B7.tmp
__PSScriptPolicyTest_jpp15d1z.2li.ps1
dujcf3kw.dll
CSCDD9BA38228594684B977F64F64571E1E.TMP
dujcf3kw.0.cs
dujcf3kw.cmdline
memory/252-17-0x000001DF7F350000-0x000001DF7F36E000-memory.dmp
memory/252-18-0x000001DF7F370000-0x000001DF7F422000-memory.dmp
memory/252-25-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-26-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-27-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-29-0x000001DF7F350000-0x000001DF7F35A000-memory.dmp
memory/252-28-0x000001DF7F590000-0x000001DF7F5A2000-memory.dmp
memory/252-61-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-23-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-22-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-21-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-2-0x00007FFA7978F000-0x00007FFA79790000-memory.dmp
memory/252-5-0x000001DF7EFE0000-0x000001DF7F002000-memory.dmp
memory/252-20-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-19-0x000001DF7F430000-0x000001DF7F43A000-memory.dmp
memory/252-24-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-6-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-7-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-13-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-12-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-11-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-10-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-9-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/252-8-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1084-0-0x0000000140000000-0x0000000140003000-memory.dmp
memory/1084-1-0x0000000140000000-0x0000000140003000-memory.dmp
memory/4960-80-0x000001DA23CA0000-0x000001DA23CA8000-memory.dmp
memory/4960-67-0x000001DA3C380000-0x000001DA3C3BE000-memory.dmp
memory/4960-66-0x000001DA241D0000-0x000001DA241FE000-memory.dmp
memory/4960-119-0x000001DA427C0000-0x000001DA427CE000-memory.dmp
memory/4960-120-0x000001DA429A0000-0x000001DA429FC000-memory.dmp