77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe
Size 521KB
Sample260916-kydbyshm41
SHA256 77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9
MD5 ec2d233837e4e81756934c38ef3ee5c2
SHA1 8f8794e297f53e90bda2272d0332506dac192677
SHA512 b9fff405f9cadbfa8ec0032d3bdcaf24553bdbf162ab9e65e290d680114fee8771d30c2ec9b060d9ad3124964d3a6aa5d5bb6df12e04b84a5e07d8f1fa8b1657
SSDEEP 12288:nYl/621ZJcw4pxOT389NB78F8pekcLZU/60:SC21ZJcw4pxa3c7b5cdy60
TLSH
T113B46C47B6A552FCD16AC078834A9673F637B88E062079BF03E487302E65F605F1DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\数据恢复说明_README.txt

Ransom Note

================================================================================ 您的文件已被加密 / YOUR FILES HAVE BEEN ENCRYPTED ================================================================================ 【中文说明】贵公司的所有重要文件已使用 AES-256 + RSA-4096 军事级加密算法加密。所有备份系统（含 NetBackup 55TB 备份）、数据库灾备（Oracle Data Guard / MSSQL Log Shipping）均已被同步销毁，无法通过任何已有备份恢复。 ◆ 重要警告：在过去数周内，我们已全面渗透贵公司内部网络，并下载了数TB规模的核心业务数据，涵盖全部数据库、文件服务器及备份系统。如果未能在规定时间内达成协议，这些数据将被公开发布或出售给竞争对手及第三方。您的唯一标识码: 1ea386a96a6bfd5ab710e743eb2a6e7a 已加密/销毁的核心业务系统包括： 1. 金蝶 EAS 财务/人力/供应链核心系统 (Oracle, 3.7TB) 2. 金蝶 EAS 业务数据库 (Oracle, 1.35TB, 含 8,496 张业务表) 3. 药品管理系统 PMS (MSSQL, 含全部药品/处方/库存数据) 4. OA 办公自动化系统 (ecology9, 含全部审批流/合同/公文) 5. CRM 客户关系管理系统 (含全部客户/销售/订单数据) 6. 人力资源系统 (17,000+ 员工信息, 含身份证号/手机号/薪资) 7. 采购管理系统 (61,500+ 用户, 含供应商/合同/报价) 8. 电子签约系统 (全部电子合同/签章记录) 9. ERP 生产管理 (物料/BOM/生产工单/质量检验) 10. 一卡通系统 (门禁/考勤/消费记录) 11. 文件服务器 (专利文档/技术资料/财务报表/审计材料) 12. 所有 NetBackup 备份 (3 台存储节点, 55TB 物理数据, 已销毁) 13. Oracle Data Guard 灾备 (实时同步副本, 已断开并销毁) 14. MSSQL Log Shipping 灾备 (3 条链路, 已断开并销毁) 15. 全部域控制器及 Active Directory (986 台域内计算机) ◆ 我们已掌握的数据 ◆ • 金蝶 EAS 财务系统完整数据库（全部财务报表/凭证/往来款/成本核算） • 17,000+ 员工完整个人信息（身份证号/手机号/家庭住址/薪资明细/社保） • 61,500+ 用户采购系统数据（供应商/合同/报价/中标记录） • 全部采购合同/投标文件/供应商报价单/定价策略 • 专利文档/药品配方/技术资料/研发数据/质检报告 • OA 系统全量数据（审批流程/内部通信/管理层会议纪要/决策记录） • CRM 客户数据（全部客户信息/销售记录/订单历史/回款明细） • 药品管理系统核心数据（全部药品注册/处方/库存/GMP 相关文件） • 电子签约系统（全部电子合同原件/签章记录/法律文件） • GitLab 代码仓库（内部系统源码及硬编码凭据） • Active Directory 域控数据（全部用户账户/密码/组策略/网络拓扑） • 邮件系统通信记录及附件 ◆ 赎金金额 ◆ USD $800,000 = 5350000人民币 24小时内联系并在3天内完成支付可享受折扣价: USD $500,000 = 3350000人民币上述金额包含： 1. 全部文件的解密工具及技术支持 2. 永久删除我们持有的所有贵公司数据（提供删除证明） 3. 安全漏洞报告（告知入侵路径，防止再次发生） 4. 我们承诺不公开、不出售、不再次联系可通过以下加密货币支付： BTC: 1DZ6V3AVf9TztSyawrLn1YC1C7E67Jjyzw XMR: 86MB9FuijDj2Cxi4vPEBXKTo5qadAE2GUPP5K8wA5LuNHFe3NcCytfAapC5MJjWEWYCSmxQpW7USiQcExuaRjwQF3UVzSM8 ETH (ERC20): 0x3b03709d520ac631e1Bc1eAD8706eE30593F0B6b USDT (TRC20): TQYxfsGpdFuubdbq9MRXz8R2DQC3pfpdK4 ◆ 时间期限 ◆ 您有 24 小时联系我们开始谈判。逾期后果如下： • 第 1 天未联系 → 赎金金额翻倍，并在公开渠道发布贵公司数据泄露公告 • 第 3 天未达成协议 → 公布部分数据样本（含员工身份证信息/财务数据） • 第 7 天 → 全量数据公开发布或出售给第三方/竞争对手数据一旦公开即不可撤回，届时即使付款也无法阻止已传播的数据。此外，个人信息泄露将触发《个人信息保护法》合规调查。 ◆ 请勿执行以下操作 ◆ • 重命名已加密文件 • 使用第三方工具尝试解密（会永久损坏文件） • 重装操作系统 • 联系执法机构（他们无法帮助恢复，且调查介入将导致我们立即公开数据） • 关闭或重启服务器（可能导致加密状态异常） • 试图自行恢复 — 所有备份系统及灾备副本均已被销毁 ◆ 如何恢复数据 ◆ 1. 通过以下方式联系我们，并提供您的唯一标识码 2. 我们将免费解密 2-3 个文件作为解密能力证明 3. 我们将提供已下载数据的样本截图作为数据持有证明 4. 达成协议后提供完整解密工具 + 永久删除所有数据联系方式 / Contact: Email-1: [email protected] Email-2: [email protected] ================================================================================ [ENGLISH] All critical files across your organization have been encrypted using military-grade AES-256 + RSA-4096 encryption. All backup systems (including NetBackup 55TB), disaster recovery replicas (Oracle Data Guard / MSSQL Log Shipping) have been destroyed simultaneously. Recovery through existing backups is impossible. ◆ CRITICAL: Over the past several weeks, we have fully infiltrated your internal network and downloaded terabytes of core business data covering all databases, file servers, and backup systems. If an agreement is not reached within the specified timeframe, this data will be published or sold to competitors and third parties. Your unique ID: 1ea386a96a6bfd5ab710e743eb2a6e7a Encrypted/destroyed core business systems include: 1. Kingdee EAS Finance/HR/SCM Core System (Oracle, 3.7TB) 2. Kingdee EAS Business Database (Oracle, 1.35TB, 8,496 tables) 3. Pharmaceutical Management System PMS (MSSQL, all drug/prescription/inventory data) 4. OA Office Automation (ecology9, all approvals/contracts/documents) 5. CRM Customer Relationship Management (all customer/sales/order data) 6. HR System (17,000+ employee records including ID numbers/phone/salary) 7. Procurement System (61,500+ users, supplier/contract/quotation data) 8. Electronic Contract Signing System (all e-contracts/digital seals) 9. ERP Production Management (materials/BOM/work orders/quality inspection) 10. Smart Card System (access control/attendance/consumption records) 11. File Servers (patent documents/technical data/financial reports/audit materials) 12. All NetBackup Backups (3 media servers, 55TB physical data, DESTROYED) 13. Oracle Data Guard DR Replica (real-time sync copy, DISCONNECTED & DESTROYED) 14. MSSQL Log Shipping DR (3 active links, DISCONNECTED & DESTROYED) 15. All Domain Controllers & Active Directory (986 domain computers) ◆ DATA IN OUR POSSESSION ◆ • Kingdee EAS Financial System (complete DB: financial reports/vouchers/AP-AR/costing) • 17,000+ employee PII (ID numbers/phone/address/salary/social security) • 61,500+ user procurement system (suppliers/contracts/quotes/bid records) • All procurement contracts/bidding docs/supplier quotes/pricing strategies • Patent documents/drug formulas/technical specs/R&D data/QC reports • OA system (all workflows/internal comms/management meeting minutes/decisions) • CRM data (all clients/sales records/order history/payment details) • Pharmaceutical Management System (drug registration/prescriptions/inventory/GMP docs) • Electronic Contract System (all original e-contracts/digital seals/legal docs) • GitLab repositories (internal source code with hardcoded credentials) • Active Directory (all accounts/passwords/group policies/network topology) • Email system communications and attachments ◆ RANSOM AMOUNT ◆ USD $800,000 = 5350000人民币 24小时内联系并在3天内完成支付可享受折扣价: USD $500,000 = 3350000人民币 This amount includes: 1. Full decryption tool with technical support 2. Permanent deletion of all your data in our possession (with proof) 3. Security vulnerability report (how we got in, to prevent recurrence) 4. Our commitment to never publish, sell, or contact you again Accepted cryptocurrency: BTC: 1DZ6V3AVf9TztSyawrLn1YC1C7E67Jjyzw XMR: 86MB9FuijDj2Cxi4vPEBXKTo5qadAE2GUPP5K8wA5LuNHFe3NcCytfAapC5MJjWEWYCSmxQpW7USiQcExuaRjwQF3UVzSM8 ETH (ERC20): 0x3b03709d520ac631e1Bc1eAD8706eE30593F0B6b USDT (TRC20): TQYxfsGpdFuubdbq9MRXz8R2DQC3pfpdK4 ◆ DEADLINE ◆ You have 24 hours to contact us and begin negotiation. Consequences of non-compliance: • Day 1 (no contact) → Ransom doubles; public breach announcement posted • Day 3 (no agreement) → Partial data samples published (employee PII/financial) • Day 7 → Full data dump published or sold to third parties/competitors Once published, this cannot be reversed. Payment after publication cannot stop data that has already spread. Additionally, PII disclosure triggers Personal Information Protection Law (PIPL) compliance investigations. ◆ DO NOT ◆ • Rename encrypted files • Attempt decryption with third-party tools (will permanently damage files) • Reinstall the operating system • Contact law enforcement (they cannot help; investigation involvement will cause us to publish data immediately) • Shutdown or restart servers (may corrupt encryption state) • Attempt self-recovery — all backups and DR replicas have been destroyed ◆ HOW TO RECOVER ◆ 1. Contact us using the methods below with your unique ID 2. We will decrypt 2-3 files for free as proof of decryption capability 3. We will provide sample screenshots of downloaded data as proof of possession 4. Full decryption tool + permanent data deletion after agreement Contact: Email-1: [email protected] Email-2: [email protected] ================================================================================

Emails

Wallets

1DZ6V3AVf9TztSyawrLn1YC1C7E67Jjyzw

Signatures

Clears Windows event logs 1 TTPs 11 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
4988	wevtutil.exe
4276	wevtutil.exe
4908	wevtutil.exe
4472	wevtutil.exe
2644	wevtutil.exe
4436	wevtutil.exe
3556	wevtutil.exe
728	wevtutil.exe
1368	wevtutil.exe
1188	wevtutil.exe
868	wevtutil.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2364	wbadmin.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2792	cmd.exe
4896	cmd.exe
408	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4988	wevtutil.exe
Token: SeBackupPrivilege	4988	wevtutil.exe
Token: SeSecurityPrivilege	3556	wevtutil.exe
Token: SeBackupPrivilege	3556	wevtutil.exe
Token: SeSecurityPrivilege	1188	wevtutil.exe
Token: SeBackupPrivilege	1188	wevtutil.exe
Token: SeSecurityPrivilege	2644	wevtutil.exe
Token: SeBackupPrivilege	2644	wevtutil.exe
Token: SeSecurityPrivilege	4276	wevtutil.exe
Token: SeBackupPrivilege	4276	wevtutil.exe
Token: SeSecurityPrivilege	4472	wevtutil.exe
Token: SeBackupPrivilege	4472	wevtutil.exe
Token: SeSecurityPrivilege	868	wevtutil.exe
Token: SeBackupPrivilege	868	wevtutil.exe
Token: SeSecurityPrivilege	728	wevtutil.exe
Token: SeBackupPrivilege	728	wevtutil.exe
Token: SeSecurityPrivilege	1368	wevtutil.exe
Token: SeBackupPrivilege	1368	wevtutil.exe
Token: SeSecurityPrivilege	4436	wevtutil.exe
Token: SeBackupPrivilege	4436	wevtutil.exe
Token: SeSecurityPrivilege	4908	wevtutil.exe
Token: SeBackupPrivilege	4908	wevtutil.exe
Token: SeBackupPrivilege	4148	wbengine.exe
Token: SeRestorePrivilege	4148	wbengine.exe
Token: SeSecurityPrivilege	4148	wbengine.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 716	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	87
PID 4308 wrote to memory of 4276	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	90
PID 4308 wrote to memory of 4908	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	91
PID 4308 wrote to memory of 4472	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	92
PID 4308 wrote to memory of 2644	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	93
PID 4308 wrote to memory of 4436	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	94
PID 4308 wrote to memory of 728	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	95
PID 4308 wrote to memory of 1368	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	96
PID 4308 wrote to memory of 1188	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	97
PID 4308 wrote to memory of 868	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	98
PID 4308 wrote to memory of 3556	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	99
PID 4308 wrote to memory of 4988	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	100
PID 4308 wrote to memory of 408	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	101
PID 4308 wrote to memory of 4896	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	102
PID 4308 wrote to memory of 2792	4308	77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe	103
PID 2792 wrote to memory of 2364	2792	cmd.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe
"C:\Users\Admin\AppData\Local\Temp\77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\system32\fltmc.exe
  "fltmc"
  2⤵
  PID:716
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4276
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4472
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-PowerShell/Operational
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:728
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Sysmon/Operational
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-TaskScheduler/Operational
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3556
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-WMI-Activity/Operational
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "del /F /Q /S C:\Windows\Prefetch\*.pf >nul 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:408
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "del /F /Q %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\*.* >nul 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:4896
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "wbadmin delete catalog -quiet >nul 2>&1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2364

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3636

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

数据恢复说明_README.txt

Path C:\Users\Admin\Downloads\数据恢复说明_README.txt
Size 9KB
SHA256 713263e8ce0f72ddf6424b660f6a7e18d43667294dd8f78b666e570d175959c0
MD5 809c75d2e1161450ef48afd9645f09f9
SHA1 d366f71c1c2b28b43a70f39cdebbaa3780a1f28f
SHA512 72f4b50f1406355050c50630b4c3311454206f5fb5e5a13bf0a0c94dcab00a947f46bb93d49785b724a6b2e0b944d5da170ba69bb9dbfea750f68c67d7b628a2
SSDEEP 192:3yvoASWrSRbGgXsrVJBwaKjCMqtiFgX0lDdXD:NASiqGnrvoqtQ7z
TLSH
T1AC225B0D2F98B544036803B33921A2793691F1B1537D8161CE98F7C2A3DCFA9D78BB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4308-204-0x00007FF6B7680000-0x00007FF6B7709000-memory.dmp

Download