Overview

overview

6

Static

static

1

kukirinek (2).exe

windows10-2004-x64

1

kukirinek (2).exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/09/2026, 16:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kukirinek (2).exe
  • Size 11.8MB
  • Sample260919-tn9f3sys9p
  • SHA256 7d2cdea3548e57edd3d099f034611c74ab16af8733153751264459c5ee05335b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryransomware

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 15 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\kukirinek (2).exe
    "C:\Users\Admin\AppData\Local\Temp\kukirinek (2).exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Windows\SysWOW64\msiexec.exe
      C:\Windows\system32\msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\vnc64.msi ProductLanguage=1033
      2⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2060
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1284
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding DC4E70027153471EB1525A8AF3F4B4A6 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1004
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1624

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a1bd7.rbs
          • Path C:\Config.Msi\e5a1bd7.rbs
          • Size 1.0MB
          • SHA256 e3be75e08221af7efc6d4575cfa359912340791fb7380e9977ba39b6fcf09379
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
          • Size 471B
          • SHA256 40a8f6c1c7f7f38ec26f3c71aca06f24db895d6efae3482a441811b69aa62d72
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          8EC9B1D0ABBD7F98B401D425828828CE_F59623AEE3E6048CCD92ADA564422513
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F59623AEE3E6048CCD92ADA564422513
          • Size 727B
          • SHA256 c8dcbe42389bf3acbf37a98d964f8a32a702ed6ce0bae22c48840dea26f8ad01
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 727B
          • SHA256 bbfc101b6607c841d3097b63998e4a52727fe6a43163fb5999ca8de58932f58b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
          • Size 400B
          • SHA256 6c098f9dd34959c4371c78cb5838f492b1afce5f78effea78edece7c171e7748
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          8EC9B1D0ABBD7F98B401D425828828CE_F59623AEE3E6048CCD92ADA564422513
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F59623AEE3E6048CCD92ADA564422513
          • Size 408B
          • SHA256 f8be7dc5b764fe97faa6c1eed3d96711a369f0daf2d54bca721eb42486509981
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 412B
          • SHA256 047bade97f20ebaf6b77530a1fa12b72190cf8d185062bb4dd252a7ba90dc5a6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vnc64.msi
          • Path C:\Users\Admin\AppData\Local\Temp\vnc64.msi
          • Size 5.5MB
          • SHA256 c156f3eb7336e4c785f2fc81fcca74c7f5f224206f2c9f755577676d0564ef37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI2463.tmp
          • Path C:\Windows\Installer\MSI2463.tmp
          • Size 1.0MB
          • SHA256 70a8258e6917b6c7618cae81deb90528d2164533e23214aeb4ea1d34f13454d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 6da7a7f204e8d97eacdcf826d0a33b16e48dc46bb6c5c94d55b7751f6dc355f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {753a13c3-5cda-4b8d-9656-99963046d664}_OnDiskSnapshotProp
          • Path \??\Volume{804c0bee-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{753a13c3-5cda-4b8d-9656-99963046d664}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 c7b34d6dcc1996801cadde84be97cabd08eb19d75d94ce9458820547722f8072
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download