Overview

overview

10

Static

static

10

0178461a83...9a.exe

windows10-2004-x64

10

0178461a83...9a.exe

windows11-ltsc_2024-x64

10

0184983a42...2d.exe

windows10-2004-x64

10

0184983a42...2d.exe

windows11-ltsc_2024-x64

10

123227e58b...97.exe

windows10-2004-x64

10

123227e58b...97.exe

windows11-ltsc_2024-x64

1

41420d040d...29.exe

windows10-2004-x64

10

41420d040d...29.exe

windows11-ltsc_2024-x64

10

47913d758d...31.exe

windows10-2004-x64

10

47913d758d...31.exe

windows11-ltsc_2024-x64

10

48586ad6d4...21.exe

windows10-2004-x64

10

48586ad6d4...21.exe

windows11-ltsc_2024-x64

10

48976d7bf3...bb.exe

windows10-2004-x64

48976d7bf3...bb.exe

windows11-ltsc_2024-x64

55219b5a69...87.exe

windows10-2004-x64

10

55219b5a69...87.exe

windows11-ltsc_2024-x64

10

55509a771f...c0.exe

windows10-2004-x64

10

55509a771f...c0.exe

windows11-ltsc_2024-x64

10

55926e8f3e...43.exe

windows10-2004-x64

10

55926e8f3e...43.exe

windows11-ltsc_2024-x64

10

56990b801d...aa.exe

windows10-2004-x64

56990b801d...aa.exe

windows11-ltsc_2024-x64

63749db0a9...f8.exe

windows10-2004-x64

63749db0a9...f8.exe

windows11-ltsc_2024-x64

10

67628a5f04...6d.exe

windows10-2004-x64

10

67628a5f04...6d.exe

windows11-ltsc_2024-x64

10

69417ec104...01.elf

ubuntu-18.04-amd64

3

72406ec12b...ea.exe

windows10-2004-x64

10

72406ec12b...ea.exe

windows11-ltsc_2024-x64

10

74494d60aa...b4.exe

windows10-2004-x64

10

74494d60aa...b4.exe

windows11-ltsc_2024-x64

10

78272eae26...61.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/10/2026, 17:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe
  • Size 223KB
  • Sample261011-v5hkcsvsc1
  • SHA256 41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files (x86)\Readme_Instructions.html

Ransom Note
  • <!DOCTYPE HTML> <html><head><title>infected with ransomware virus</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> </head> <body style="margin: 0.4em; font-size: 14pt;"><p>!!!&nbsp; &nbsp; Your files are encrypted&nbsp; !!!<br><br>*All your files are protected with encryption*<br>*There is no public decryption software.*<br>*All files/documents/software with ".CRYPT" extension is encrypted*<br><br><br>###### Program and private key, What is the price? The price depends on how fast you can pay us.!######<br>1 day : 50 Bitcoin<br>2 day : 60 Bitcoin<br>3 day : 90 Bitcoin<br>4 day : 130 Bitcoin<br> 5 day&nbsp; &nbsp; : permanent data loss !!!!<br><br> ***How to contact our team through tox chat***<br><br>*Download tox chat from<br>*<a href="https://tox.chat/download.html">https://tox.chat/download.html</a><br>*send us friend request to tox chat id <br><br>7D8796EB86CBF29F53F8A8447EABAF310ED898D9DEFF97AE09C1864C2A6B3B14ED8F82AE9B9D<br><br>*Our team is waiting*<br><br>!!!!For immediate decryption!!!<br><br>write to our email:<br><br><a href="mailto:[email protected]">[email protected]</a><br><br> *After payment received, we will send private key to your IT department.!!!*<br><br> *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.*<br><br>!!! We have downloaded all your files to our servers and will release data if you do not comply.!!!<br>!!! Do not attempt to decrypt your data using third-party software, this will result in permanent data loss.!!!</p></body></html>
Emails
URLs

  • http-equiv="X-UA-Compatible"

Signatures

  • Renames multiple (9838) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe
    "C:\Users\Admin\AppData\Local\Temp\41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe"
    1⤵
    • Creates a file in the Startup directory
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{99139261-C798-4EFC-9337-6B5D143287A8}'" delete
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4304
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{99139261-C798-4EFC-9337-6B5D143287A8}'" delete
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4408
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3240

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Readme_Instructions.html
        • Path C:\Program Files (x86)\Readme_Instructions.html
        • Size 1KB
        • SHA256 cef2395cc2ae718f07b84bdbae435752c0e7049aa6de8488ab045c07f5fd0b37
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AddExpand.bin
        • Path C:\Users\Admin\Downloads\AddExpand.bin
        • Size 220KB
        • SHA256 410438c5dceb341aedea1220c06b99cdd03ec3e72990e7f88c9c9d688464df4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BackupClose.zip
        • Path C:\Users\Admin\Downloads\BackupClose.zip
        • Size 506KB
        • SHA256 f539c2f4c54bbc9ff02c14264237060e0e7ed73967c4e15aa848723c9709c713
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download