Overview

overview

9

Static

static

3

pc.exe

windows10-2004-x64

pc.exe

windows11-ltsc_2024-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 20:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pc.exe
  • Size 7.0MB
  • Sample261024-yspppawyet
  • SHA256 6c959255151e971aa4fffb2e97a2810743b8d6e7427d45ca2cc22e93ba8e02ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 26 IoCs
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\pc.exe
    "C:\Users\Admin\AppData\Local\Temp\pc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\pc.exe
      "C:\Users\Admin\AppData\Local\Temp\pc.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Drops desktop.ini file(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Windows\SYSTEM32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:3432
      • C:\Windows\SYSTEM32\wbadmin.exe
        wbadmin delete systemstatebackup -deleteOldest -quiet
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:2544
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5532
  • C:\Windows\system32\ctfmon.exe
    /QuitInfo:0000000000000268;000000000000026C;
    1⤵
      PID:4824
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
        PID:2600
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
        1⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:5764
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
          PID:4440
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:4844
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:4340
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
                PID:5640
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                  PID:1848
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k CameraMonitor
                  1⤵
                    PID:2016

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        Windows Management Instrumentation

                        1
                        T1047

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Defense Evasion

                        Direct Volume Access

                        1
                        T1006

                        Indicator Removal

                        3
                        T1070

                        File Deletion

                        3
                        T1070.004

                        Credential Access

                        Credentials from Password Stores

                        2
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Windows Credential Manager

                        1
                        T1555.004

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        2
                        T1012

                        System Information Discovery

                        2
                        T1082

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Inhibit System Recovery

                        3
                        T1490

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        VCRUNTIME140.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\VCRUNTIME140.dll
                        • Size 121KB
                        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _bz2.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\_bz2.pyd
                        • Size 71KB
                        • SHA256 c46b2979e25b66827d0361a559e12879b8a250cf5c8771a54db94e4808e00685
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _ctypes.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\_ctypes.pyd
                        • Size 116KB
                        • SHA256 c10b0b0f800c1327cb627a342b9afc5960d436e9e08b02f5d6971da69e4722c5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _decimal.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\_decimal.pyd
                        • Size 237KB
                        • SHA256 5566518542e3ee6dd8cbecbae76e40a30015e82cc04ee4ea768a3cc9fb53f4ce
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _hashlib.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\_hashlib.pyd
                        • Size 52KB
                        • SHA256 5f17438d0e3091e6006048c873ce43e7e33d842a2a736500815a56aa8be4bf01
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _lzma.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\_lzma.pyd
                        • Size 149KB
                        • SHA256 0369454200d4b8deb3959415aae9bb9926e681b14bcb4427e432381fe57ecb27
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _socket.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\_socket.pyd
                        • Size 66KB
                        • SHA256 9bc8b64506c21e94457da274573e85777a06b67d4d6b98dddeab4b97172fcef1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        base_library.zip
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\base_library.zip
                        • Size 1.4MB
                        • SHA256 eb3127dcd36012595f83742627653390bb2bcf3e89d8ca5abe9085e0d253c07d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libcrypto-3-x64.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\libcrypto-3-x64.dll
                        • Size 7.6MB
                        • SHA256 4ef4f59ddc79f232a76e7eee7a7fd91792974ba885011b00acada8debfc14173
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libffi-8.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\libffi-8.dll
                        • Size 27KB
                        • SHA256 d56b5e5aa064e35f9ae5d11d2f0833a591d946bc04b85e1772ddfa7c84eb33a3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        python311.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\python311.dll
                        • Size 5.6MB
                        • SHA256 06cb189016f6d5a593aba0e4c53ae972f2b7a257373c502e7da80f35f37dc1c0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        select.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\select.pyd
                        • Size 18KB
                        • SHA256 ab91970ff8458849e59711e323dc49f09bafe7a650ddcf797fd7242343ebc49d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        unicodedata.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000adc2\unicodedata.pyd
                        • Size 1.1MB
                        • SHA256 aa489115a8139de6aa0db51e2c8771c78df430fd7c3c65b714f385833ccc91fe
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AddConvertTo.snd
                        • Path C:\Users\Admin\Downloads\AddConvertTo.snd
                        • Size 233KB
                        • SHA256 5c6cfe19036b65d50a217ff91d9b25d39ae24e8c714a43364dd144ed46642a7a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ApproveOptimize.wmf
                        • Path C:\Users\Admin\Downloads\ApproveOptimize.wmf
                        • Size 350KB
                        • SHA256 27f6c7f989f83fc75f68fa76df4aeada199c4d18dd112fb022dd65fbdf574116
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        BackupUnblock.rle
                        • Path C:\Users\Admin\Downloads\BackupUnblock.rle
                        • Size 418KB
                        • SHA256 d9e207212c14e6824d883089d2dc7eb7d263625947f5af437613cb3670129a2d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download