aesrt | 05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Size 1.4MB
Sample261011-v4fdlsbv7x
SHA256 05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f
MD5 0ada88218b67a313a4f5ab0062fbc4e6
SHA1 15dfcef932d666fdc7501bcee357ec2aabfcfdee
SHA512 0b217e5aa8b17d347dbb05507cb5cf179328aad593fb65a8083ca8c300de4901eb55e6c8e971ce3280f50ceefd327332cfafde0280e09044d8da1dc8e20a49ed
SSDEEP 24576:J6w15zVAFj5WEx9+22sHFXVYmLmYy+vz236ZSV8BGxon3sgGhzl1KsIVy:QsV85WU9+ElYmyZMz23sSyBGdgelIsj
TLSH
T17F65138581910B9BDC0143339D271B86BBB108355174EB16FBE3B39D7DE9310BE46AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution aesrt impact persistence ransomware trojan

Malware Config

Signatures

Family: AESRT
AESRT is a ransomware.
ransomware aesrt

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe,"	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (131) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File created	C:\Users\Admin\Downloads\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File created	C:\Users\Admin\Videos\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File created	C:\Users\Admin\Music\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File created	C:\Users\Admin\Pictures\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ShellExperience = "\"ShellExperience.exe\""	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\Wallpaper = "C:\\Program Files\\Temp\\AESRT\\AESRTback.png"	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Temp\AESRT\AESRTback.png	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File opened for modification	C:\Program Files\Temp\AESRT\refresh.bat	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5000	cmd.exe
1268	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3952	WMIC.exe
Token: SeSecurityPrivilege	3952	WMIC.exe
Token: SeTakeOwnershipPrivilege	3952	WMIC.exe
Token: SeLoadDriverPrivilege	3952	WMIC.exe
Token: SeSystemProfilePrivilege	3952	WMIC.exe
Token: SeSystemtimePrivilege	3952	WMIC.exe
Token: SeProfSingleProcessPrivilege	3952	WMIC.exe
Token: SeIncBasePriorityPrivilege	3952	WMIC.exe
Token: SeCreatePagefilePrivilege	3952	WMIC.exe
Token: SeBackupPrivilege	3952	WMIC.exe
Token: SeRestorePrivilege	3952	WMIC.exe
Token: SeShutdownPrivilege	3952	WMIC.exe
Token: SeDebugPrivilege	3952	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3952	WMIC.exe
Token: SeRemoteShutdownPrivilege	3952	WMIC.exe
Token: SeUndockPrivilege	3952	WMIC.exe
Token: SeManageVolumePrivilege	3952	WMIC.exe
Token: 33	3952	WMIC.exe
Token: 34	3952	WMIC.exe
Token: 35	3952	WMIC.exe
Token: 36	3952	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3952	WMIC.exe
Token: SeSecurityPrivilege	3952	WMIC.exe
Token: SeTakeOwnershipPrivilege	3952	WMIC.exe
Token: SeLoadDriverPrivilege	3952	WMIC.exe
Token: SeSystemProfilePrivilege	3952	WMIC.exe
Token: SeSystemtimePrivilege	3952	WMIC.exe
Token: SeProfSingleProcessPrivilege	3952	WMIC.exe
Token: SeIncBasePriorityPrivilege	3952	WMIC.exe
Token: SeCreatePagefilePrivilege	3952	WMIC.exe
Token: SeBackupPrivilege	3952	WMIC.exe
Token: SeRestorePrivilege	3952	WMIC.exe
Token: SeShutdownPrivilege	3952	WMIC.exe
Token: SeDebugPrivilege	3952	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3952	WMIC.exe
Token: SeRemoteShutdownPrivilege	3952	WMIC.exe
Token: SeUndockPrivilege	3952	WMIC.exe
Token: SeManageVolumePrivilege	3952	WMIC.exe
Token: 33	3952	WMIC.exe
Token: 34	3952	WMIC.exe
Token: 35	3952	WMIC.exe
Token: 36	3952	WMIC.exe
Token: SeBackupPrivilege	3376	vssvc.exe
Token: SeRestorePrivilege	3376	vssvc.exe
Token: SeAuditPrivilege	3376	vssvc.exe
Token: SeDebugPrivilege	2776	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 5000	2776	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe	90
PID 5000 wrote to memory of 3952	5000	cmd.exe	92
PID 2776 wrote to memory of 1268	2776	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe	101
PID 1268 wrote to memory of 2808	1268	cmd.exe	103
PID 1268 wrote to memory of 4572	1268	cmd.exe	104
PID 1268 wrote to memory of 4372	1268	cmd.exe	105
PID 1268 wrote to memory of 4648	1268	cmd.exe	106
PID 1268 wrote to memory of 3152	1268	cmd.exe	107

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
"C:\Users\Admin\AppData\Local\Temp\05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Temp\AESRT\refresh.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4572
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4372
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4648
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3152

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

refresh.bat

Path C:\Program Files\Temp\AESRT\refresh.bat
Size 378B
SHA256 98ba9ab619027be3265fd7827270e1ec59fbe39b79f98c65c17712f667c7fe8a
MD5 0c7022bc17761ecace63d45343c9d2fd
SHA1 7fdf53bc92830e4e5935f61d745a055edd3fc9e3
SHA512 ea434972b6fbffdf6c59e083cc1ed55557b4aa9113413f387b20c5eaf212a86ce995d4c8a93251cc22b9fd8b7ae4fc4125bbc85f5caca2dad8d81f4bb05dba5a
TLSH
T1A1E02200CB208A808C228C008BC8A0B0B0AC20CBF83F000202B00A830C2BC3CB2E338C
MD5 SHA1 SHA512 TLSH

Submit Download

BackupSplit.jtx

Path C:\Users\Admin\Downloads\BackupSplit.jtx
Size 528KB
SHA256 81928dbadc2ecf23151280561e6319122ce0ae3b1e5d4f6d7fbb1d5b1af11373
MD5 77af2eec34b70cfe3d78c75feb03a229
SHA1 767fac8c420c1850c43ac80a2aa24ba10180cef5
SHA512 47d0a263fb0dd2d92f2ae31431cae1dd0a5df882deeb413a9c7150d2fa0eae4ef6f140804a52078d2108fb79ea1e8cb00e700099cf94c6b4604adc4248cff80c
SSDEEP 12288:DBpF6yhECCHmXodsrQPxq3AIKFxuShm4ROGr+amM2:DrF6yiCCGXod3PWOm4ROdP
TLSH
T1D9B4238CD554B316A74BE209AE32310E7481A728FB56766E49438242B4FFDDFDB27D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmSet.csv

Path C:\Users\Admin\Downloads\ConfirmSet.csv
Size 585KB
SHA256 907ae9200f87971b75da4b57f132f70c2632f55a4ad0f34e5155dc0c57244da4
MD5 6f2d0bca92cf68838de4930778a02e47
SHA1 bb93272f3103f875dc77180a225f38705dbd8e6d
SHA512 0e191609ad3cab930bec6f4b649fa7415ab10b042ee89c8fad7f174bfad38c6971ea9faffbb64c9273ff590d66089d5ef151604c419facbfa37d38bab25c664b
SSDEEP 12288:vHoz+VE8bcPIpcXSTKxhfIDtqBtEPhqYY4R+LWVji8z9mBVtLac+sI1LEXf:UqEskiexBI5qU+4R6aJz9UicS1LEP
TLSH
T102D42364D02201E1E164BA7003209C5FFD7C68637A53296DDC696C971AB2BE6E0F37ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromSave.edrwx

Path C:\Users\Admin\Downloads\ConvertFromSave.edrwx
Size 232KB
SHA256 07324db7f2a57fa991e2888a6cf8106a0341f3a2017f1acd47f2beed1ff82888
MD5 45e9df22deb722ac253562d9719e1954
SHA1 1bb047421c4b6f538ff6152e07372788057b4472
SHA512 8c1f13936d6e1c7142dd396d90827714accd7b9de87c0d4c37d362b3bfbfce5bb14da68ea38a30ec337270c3e9096b55056252a0193ba2aed468905989a05771
SSDEEP 6144:VrmWlK4ZxHsR3Dn9CGELN2VEc1awvzUYxdN1/5q:d4yMR3ZCWVr1awwY7N1Bq
TLSH
T18E34231151C64F3C9661D20251A40E01FD75103BB96FBFB5BE8EDA88F8B4B168D3B6B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2776-0-0x0000000000C40000-0x0000000000DA8000-memory.dmp

Download

memory/2776-3-0x0000000005DD0000-0x0000000006374000-memory.dmp

Download

memory/2776-4-0x0000000005820000-0x00000000058B2000-memory.dmp

Download

memory/2776-5-0x00000000066D0000-0x00000000066E0000-memory.dmp

Download

memory/2776-399-0x0000000006920000-0x000000000692A000-memory.dmp

Download

memory/2776-400-0x00000000066D0000-0x00000000066E0000-memory.dmp

Download

memory/2776-404-0x00000000066D0000-0x00000000066E0000-memory.dmp

Download

memory/2776-405-0x00000000066D0000-0x00000000066E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads