aesrt | 05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Size 1.4MB
Sample261011-v4fdlsbv7x
SHA256 05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f
MD5 0ada88218b67a313a4f5ab0062fbc4e6
SHA1 15dfcef932d666fdc7501bcee357ec2aabfcfdee
SHA512 0b217e5aa8b17d347dbb05507cb5cf179328aad593fb65a8083ca8c300de4901eb55e6c8e971ce3280f50ceefd327332cfafde0280e09044d8da1dc8e20a49ed
SSDEEP 24576:J6w15zVAFj5WEx9+22sHFXVYmLmYy+vz236ZSV8BGxon3sgGhzl1KsIVy:QsV85WU9+ElYmyZMz23sSyBGdgelIsj
TLSH
T17F65138581910B9BDC0143339D271B86BBB108355174EB16FBE3B39D7DE9310BE46AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution aesrt impact persistence ransomware trojan

Malware Config

Signatures

Family: AESRT
AESRT is a ransomware.
ransomware aesrt

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe,"	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (103) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
defense_evasion

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File created	C:\Users\Admin\Videos\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File created	C:\Users\Admin\Music\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File created	C:\Users\Admin\Pictures\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File created	C:\Users\Admin\Desktop\desktop.ini	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ShellExperience = "\"ShellExperience.exe\""	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Desktop\Wallpaper = "C:\\Program Files\\Temp\\AESRT\\AESRTback.png"	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Temp\AESRT\AESRTback.png	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
File opened for modification	C:\Program Files\Temp\AESRT\refresh.bat	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5104	cmd.exe
3752	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4132	WMIC.exe
4132	WMIC.exe
4132	WMIC.exe
4132	WMIC.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4132	WMIC.exe
Token: SeSecurityPrivilege	4132	WMIC.exe
Token: SeTakeOwnershipPrivilege	4132	WMIC.exe
Token: SeLoadDriverPrivilege	4132	WMIC.exe
Token: SeSystemProfilePrivilege	4132	WMIC.exe
Token: SeSystemtimePrivilege	4132	WMIC.exe
Token: SeProfSingleProcessPrivilege	4132	WMIC.exe
Token: SeIncBasePriorityPrivilege	4132	WMIC.exe
Token: SeCreatePagefilePrivilege	4132	WMIC.exe
Token: SeBackupPrivilege	4132	WMIC.exe
Token: SeRestorePrivilege	4132	WMIC.exe
Token: SeShutdownPrivilege	4132	WMIC.exe
Token: SeDebugPrivilege	4132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4132	WMIC.exe
Token: SeRemoteShutdownPrivilege	4132	WMIC.exe
Token: SeUndockPrivilege	4132	WMIC.exe
Token: SeManageVolumePrivilege	4132	WMIC.exe
Token: 33	4132	WMIC.exe
Token: 34	4132	WMIC.exe
Token: 35	4132	WMIC.exe
Token: 36	4132	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4132	WMIC.exe
Token: SeSecurityPrivilege	4132	WMIC.exe
Token: SeTakeOwnershipPrivilege	4132	WMIC.exe
Token: SeLoadDriverPrivilege	4132	WMIC.exe
Token: SeSystemProfilePrivilege	4132	WMIC.exe
Token: SeSystemtimePrivilege	4132	WMIC.exe
Token: SeProfSingleProcessPrivilege	4132	WMIC.exe
Token: SeIncBasePriorityPrivilege	4132	WMIC.exe
Token: SeCreatePagefilePrivilege	4132	WMIC.exe
Token: SeBackupPrivilege	4132	WMIC.exe
Token: SeRestorePrivilege	4132	WMIC.exe
Token: SeShutdownPrivilege	4132	WMIC.exe
Token: SeDebugPrivilege	4132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4132	WMIC.exe
Token: SeRemoteShutdownPrivilege	4132	WMIC.exe
Token: SeUndockPrivilege	4132	WMIC.exe
Token: SeManageVolumePrivilege	4132	WMIC.exe
Token: 33	4132	WMIC.exe
Token: 34	4132	WMIC.exe
Token: 35	4132	WMIC.exe
Token: 36	4132	WMIC.exe
Token: SeBackupPrivilege	4596	vssvc.exe
Token: SeRestorePrivilege	4596	vssvc.exe
Token: SeAuditPrivilege	4596	vssvc.exe
Token: SeDebugPrivilege	1300	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 5104	1300	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe	90
PID 5104 wrote to memory of 4132	5104	cmd.exe	92
PID 1300 wrote to memory of 3752	1300	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe	97
PID 3752 wrote to memory of 4192	3752	cmd.exe	99
PID 3752 wrote to memory of 6000	3752	cmd.exe	100
PID 3752 wrote to memory of 4528	3752	cmd.exe	101
PID 3752 wrote to memory of 1892	3752	cmd.exe	102
PID 3752 wrote to memory of 4612	3752	cmd.exe	103

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
"C:\Users\Admin\AppData\Local\Temp\05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Temp\AESRT\refresh.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4192
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6000
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4528
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1892
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

refresh.bat

Path C:\Program Files\Temp\AESRT\refresh.bat
Size 378B
SHA256 98ba9ab619027be3265fd7827270e1ec59fbe39b79f98c65c17712f667c7fe8a
MD5 0c7022bc17761ecace63d45343c9d2fd
SHA1 7fdf53bc92830e4e5935f61d745a055edd3fc9e3
SHA512 ea434972b6fbffdf6c59e083cc1ed55557b4aa9113413f387b20c5eaf212a86ce995d4c8a93251cc22b9fd8b7ae4fc4125bbc85f5caca2dad8d81f4bb05dba5a
TLSH
T1A1E02200CB208A808C228C008BC8A0B0B0AC20CBF83F000202B00A830C2BC3CB2E338C
MD5 SHA1 SHA512 TLSH

Submit Download

AddCopy.mpp

Path C:\Users\Admin\Downloads\AddCopy.mpp
Size 527KB
SHA256 8a10b90e9c123f9a8405669e3ee76271f0be47c6ec76e7a0831461c3ccd92ddb
MD5 c667c77dc8de30a93634ced272c69e77
SHA1 838672d922ead19a0e2b9d9f05c773867855850b
SHA512 4f01c9ba09f5d1f43cb7c9714d0f74340cfa11e9a96df86e7251578fb19027bbaf68b558601f3b4fc8be3e120e6257bbb9021797e9f7ba3f8d42ec72c86748b0
SSDEEP 12288:+xhENoyhkjWBlYQVOoZrXm1jQJ8K1/irMGkaWgZk9f7xAkBY1Mg:ohECpjWPOoZZ/irMtGQAkBYOg
TLSH
T12DB4237B86C3F8653AD9D6036229F762E01FC97F99558E10066E41F3364736A8E23393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApproveRevoke.xlsx

Path C:\Users\Admin\Downloads\ApproveRevoke.xlsx
Size 512KB
SHA256 fde56780b0c1b47a401732b31051dcc3e7bea35dc8fb8459f5a33c3fdfa8993a
MD5 4165d0d54a16ed1307c3e4f263a387b8
SHA1 639e25adc5797d74d96ee5e7832fc3a1a9905479
SHA512 127829504084ad6d30e135c0a7cdc08e380c1045c3d1e30a423684975b555eace89dd21e90ffbc71e4beee40aa47165fd71e5eb0ae8f76887d42bc6cac7decc1
SSDEEP 12288:nqzVLm9FDd8ct9/lEGqnT8NBKTklEKRyO+I1uaBpTYGB:nqzVL+FWc+GqnYNBKyEKRll1ump8GB
TLSH
T134B42336DB241FF56BF7D289BAC84461653F2257347EFF128B3D9489DA26BA480520CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertExit.vsdm

Path C:\Users\Admin\Downloads\AssertExit.vsdm
Size 647KB
SHA256 de6f7b5548d6e778dfa0707b1e16ff78fb9bae084d9cc713f88dc161562c68b6
MD5 70610b83e681c9eba1fa5f67e67f3747
SHA1 da4f7735c21a84272f633b7f775a8e9629dd9e0d
SHA512 d04427318b039c186e74b6b882c6cee73557b64532335da202f0a5c701aaaccf9a987c47e99553092cd982772390115e8622e0765cd56d5b14f94443b7875965
SSDEEP 12288:aulLKTIAtp4UMaFr0G9PkJVQhUStxPGel7jaBvTF22/5Z674L96UJ7OxwV:3AtmUMeAO7hUSrPcTE2/3tL96uOw
TLSH
T121E433F546FA6DDB54EEAFCD238E3070620CA705524D962F525A4886C300E1CDDFAEE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-5-0x0000000005BE0000-0x0000000005C72000-memory.dmp

Download

memory/1300-9-0x00000000746B0000-0x0000000074E6C000-memory.dmp

Download

memory/1300-0-0x00000000746C2000-0x00000000746C3000-memory.dmp

Download

memory/1300-4-0x00000000061A0000-0x000000000675A000-memory.dmp

Download

memory/1300-316-0x0000000005630000-0x000000000563A000-memory.dmp

Download

memory/1300-317-0x00000000746B0000-0x0000000074E6C000-memory.dmp

Download

memory/1300-1-0x0000000000F10000-0x0000000001078000-memory.dmp

Download

memory/1300-325-0x00000000746C2000-0x00000000746C3000-memory.dmp

Download

memory/1300-326-0x00000000746B0000-0x0000000074E6C000-memory.dmp

Download

memory/1300-327-0x00000000746B0000-0x0000000074E6C000-memory.dmp

Download