Overview

overview

10

Static

static

10

2026-09-27...ub.exe

windows10-2004-x64

10

2026-09-27...ub.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 02:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-27_96d876c087c0bb96cf560af9ddba1555_elex_makop_neshta_ransomhub.exe
  • Size 94KB
  • Sample260928-c43j2atbnd
  • SHA256 2f241685d9d28358b4d052b11d9d932fdcab44abde9d1c119ec634f19964cef9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionmakopneshtaimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\+README-WARNING+.txt

Ransom Note
  • Dear Management, If you are reading this message, it means that: - your network infrastructure has been compromised, - critical data was leaked, - files are encrypted -------------------------------------------------------------------------- The best and only thing you can do is to contact us to settle the matter before any losses occurs. Mail : [email protected] If you do not receive a response within 12 hours, your letter may not have arrived, in this case we provide an alternative contact Chat qtox : https://tox.chat/download.html Our chat ID : AAB6501458C81B17E9CA1993F1B18BCFB13C9CFB49F70D01560CF0688AF3634F53FA58F31EBA -------------------------------------------------------------------------- 1. THE FOLLOWING IS STRICTLY FORBIDDEN 1.1 EDITING FILES ON HDD. Renaming, copying or moving any files could DAMAGE the cipher and decryption will be impossible. 1.2 USING THIRD-PARTY SOFTWARE. Trying to recover with any software can also break the cipher and file recovery will become a problem. 1.3 SHUTDOWN OR RESTART THE PC. Boot and recovery errors can also damage the cipher. Sorry about that, but doing so is entirely at your own risk. -------------------------------------------------------------------------------------------------- 2. EXPLANATION OF THE SITUATION 2.1 HOW DID THIS HAPPEN The security of your IT perimeter has been compromised (it's not perfect at all). We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks. We spent a lot of time researching and finding out the most important directories of your business, your weak points. We have already downloaded a huge amount of critical data and analyzed it. Now its fate is up to you, it will either be deleted or sold, or shared with the media. 2.2 VALUABLE DATA WE USUALLY STEAL: - Databases, legal documents, personal information. - Audit reports. - Audit SQL database - Any financial documents (Statements, invoices, accounting, transfers etc.). - Work files and corporate correspondence. - Any backups. - Confidential documents. 2.3 TO DO LIST (best practies) - Contact us as soon as possible. - Contact us only in our live chat, otherwise you can run into scammers. - Purchase our decryption tool and decrypt your files. There is no other way to do this. - Realize that dealing with us is the shortest way to success and secrecy. - Give up the idea of using decryption help programs, otherwise you will destroy the system permanently. - Avoid any third-party negotiators and recovery groups. They can become the source of leaks. -------------------------------------------------------------------------------------------------- 3. POSSIBLE DECISIONS 3.1 NOT MAKING THE DEAL - After 4 days starting tomorrow your leaked data will be Disclosed or sold. - We will also send the data to all interested supervisory organizations and the media. - Decryption key will be deleted permanently and recovery will be impossible. - Losses from the situation can be measured based on your annual budget. 3.2 MAKING THE WIN-WIN DEAL - You will get the only working Decryption Tool and the how-to-use Manual. - You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data. - You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet. - You will get our security report on how to fix your security breaches. -------------------------------------------------------------------------------------------------- 4. Your Information and Keys 4.1 All leaked Data samples will be Disclosed in 7 Days if you remain silent. 4.2 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed. -------------------------------------------------------------------------------------------------- 5. RESPONSIBILITY 5.1 Breaking critical points of this offer will cause: - Deletion of your decryption keys. - Immediate sale or complete Disclosure of your leaked data. - Notification of government supervision agencies, your competitors and clients.
URLs

  • https://tox.chat/download.html

Signatures

  • Family: Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 7 IoCs
  • MAKOP ransomware payload 1 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (8833) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 8 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_96d876c087c0bb96cf560af9ddba1555_elex_makop_neshta_ransomhub.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_96d876c087c0bb96cf560af9ddba1555_elex_makop_neshta_ransomhub.exe"
    1⤵
    • Modifies system executable filetype association
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1296
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-27_96d876c087c0bb96cf560af9ddba1555_elex_makop_neshta_ransomhub.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-27_96d876c087c0bb96cf560af9ddba1555_elex_makop_neshta_ransomhub.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1408
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3476
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:5476
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:2548
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3176
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\+README-WARNING+.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4568
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5748
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5656
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:1036
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:5864
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4360

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Direct Volume Access

          1
          T1006

          Indicator Removal

          3
          T1070

          File Deletion

          3
          T1070.004

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          2
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Windows Credential Manager

          1
          T1555.004

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          5
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Defacement

          1
          T1491

          Inhibit System Recovery

          3
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ACROTE~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
          • Size 86KB
          • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          stable.identity_helper.exe.manifest
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\stable.identity_helper.exe.manifest
          • Size 1KB
          • SHA256 93e65799e5bd8f2611e8508fa7633a8ae4fb3a7afe40ab0deeeb2674182560d9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Advertising
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\Advertising
          • Size 24KB
          • SHA256 4eb1c5843d541b066c1086bb718b932fc4b6043f6b8db10c5e3b9c5e581af2af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Analytics
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\Analytics
          • Size 4KB
          • SHA256 88be10f4dfd1ed1123500735d38221baa134402141cb81d725cc3a61dd56f6ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CompatExceptions
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\CompatExceptions
          • Size 948B
          • SHA256 007e68deb8037c4b9a61b56c0d82d5f57131391e806004a7d51b38606160b0ae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Content
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\Content
          • Size 6KB
          • SHA256 ac238bbad7f7545b25f174b3bc7ee00611d27074816392722cbf7041164685bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Cryptomining
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\Cryptomining
          • Size 1KB
          • SHA256 cccbfb6274ead98dbbdf6b92bd475dc82cbcf0af2cd183f63e6ee8455da01224
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Entities
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\Entities
          • Size 68KB
          • SHA256 304be197907c0da27a73be4e1c383db40c3d6a10a9aeae3bc6f824058cf576c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Fingerprinting
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\Fingerprinting
          • Size 1KB
          • SHA256 9d6f4fc5419f4deb1ee6041cabe41075cd98dc37eb0556a8534c2005b819aa3d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\LICENSE
          • Size 34KB
          • SHA256 5df988af4572fc03184360c6b9ea3bd192839f34b8f66868af14120f81a70ca5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Other
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\Other
          • Size 260B
          • SHA256 c7915e5528d987cd852a46ed71c67389cd3b64da0f39ce2ce1f338d9e7b386d7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Social
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\Social
          • Size 596B
          • SHA256 1e9366f3061de415568e7406320b219f3ab3290ee470dbaea97b87fc60491ccf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TransparentAdvertisers
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\TransparentAdvertisers
          • Size 372B
          • SHA256 f52179985189b42f6fb0f34780f72e5a3845d4c0e13e2fee007031ef472cae98
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Advertising
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Sigma\Advertising
          • Size 2KB
          • SHA256 debbfa6082b9072deef6830611a81862dc46f0dbc5a7256d776b3857a0350ac9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Analytics
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Sigma\Analytics
          • Size 660B
          • SHA256 529f02b766b7cc0b46670e34296f74eabd55f8c0a5c5a1852854cf5c22d44db3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\manifest.json
          • Size 372B
          • SHA256 7781550bd7403617b79294c02fcd7bafaa62fe4389c822bf4a7e7bd301ed51e6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          resources.pak
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\resources.pak
          • Size 704KB
          • SHA256 4075e907635fed6b23e62d02d6a33410e1991a666c1e737854ec2eef78b3f30d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          +README-WARNING+.txt
          • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\+README-WARNING+.txt
          • Size 5KB
          • SHA256 4ef0420eac2eef8128900bb9aaa7bfd412a416921645ab72a7f3186f1864c145
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-09-27_96d876c087c0bb96cf560af9ddba1555_elex_makop_neshta_ransomhub.exe
          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-27_96d876c087c0bb96cf560af9ddba1555_elex_makop_neshta_ransomhub.exe
          • Size 54KB
          • SHA256 82572a87f84d2a4af97bf68a49279c09151940c99e055a01c674b032bb17e905
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tmp5023.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
          • Size 244B
          • SHA256 fc2f305088bf27b7d67133b085ac5c27c79637a7d5d7516ea5de2ab9ff3c824e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1296-14087-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1296-9126-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1296-7720-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1296-7718-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1296-430-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1296-363-0x0000000000400000-0x000000000041B000-memory.dmp
          Download