Analysis
- max time kernel
60s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/11/2026, 16:57
General
- Target 007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe
- Size 728KB
- Sample261104-vgfqvsys7k
- SHA256 007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2
Score
10/10
Malware Config
Extracted
Path
-
C:\ProgramData\__________WHY FILES NOT WORK__________.txt
Ransom Note
- Attention! Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team! We used nextgen strong cryptography in order to encrypt your files. The only way to restore your files is to buy decryptor! * You must know the worst thing is happened now and you cannot hide our successful attack! Understand if payment is not made on time. All your company data will be permanently destroyed. Your backups has been fatal and it is just a waste of your precious time if going to try them! * IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW 1. Copy your Network ID and send to our email. Network ID : DM5V6T52K4 Email : [email protected] 2. You will receive a amount and payment order. 3. We will send you decryptor with private key to recovery your files. * You can ask for 1 free file decryption as proof of work in the first correspondence! * Your time for save your files has limited to one week (from first impact) before we delete our temporary email address! * Data manipulation cause permanent loss of files!
Emails
Signatures
- Renames multiple (121) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe"C:\Users\Admin\AppData\Local\Temp\007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C ping 127.0.0.1 -n 5 > NUL && del /Q /F "C:\Users\Admin\AppData\Local\Temp\007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__________WHY FILES NOT WORK__________.txt
memory/2676-0-0x0000000000400000-0x0000000000609000-memory.dmp
memory/2676-667-0x0000000000400000-0x0000000000609000-memory.dmp