438888ef36bad1079af79daf152db443b4472c5715a7b3da0ba24cc757c53499

max time kernel
120s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ransomware/Rokku.exe
Size 666KB
Sample261111-cb2f9sts2r
SHA256 438888ef36bad1079af79daf152db443b4472c5715a7b3da0ba24cc757c53499
MD5 97512f4617019c907cd0f88193039e7c
SHA1 24cfa261ee30f697e7d1e2215eee1c21eebf4579
SHA512 cfbb8dd91434f917d507cb919aa7e6b16b7b2056d56185f6ad5b6149e05629325cdb3df907f58bb3f634b17a9989bf5b6d6b81f5396a3a556431742ed742ac4a
SSDEEP 12288:bB/72HFAQBMiZB7fJJ2qDHKK/K5FJL+xQhrwjeI:bBKqFiT7fJJ2qbKK6F5+xQhrEJ
TLSH
T1D6E4232F4D4C2BEBEB4A58B0B4CB7BD94FE8153A52D85AD18718DB95F5760284340C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact ransomware upx

Malware Config

Extracted

Path

C:\Recovery\WindowsRE\README_HOW_TO_UNLOCK.TXT

Ransom Note

YOUR FILE HAS BEEN LOCKED In order to unlock your files, follow the instructions bellow: 1. Download and install Tor Browser 2. After a successful installation, run Tor Browser and wait for its initialization. 3. Type in the address bar: http://zvnvp2rhe3ljwf2m.onion 4. Follow the instructions on the site.

URLs

http://zvnvp2rhe3ljwf2m.onion

Extracted

Path

C:\Users\Admin\Downloads\README_HOW_TO_UNLOCK.HTML

Ransom Note

YOUR FILE HAS BEEN LOCKED In order to unlock your files, follow the instructions bellow: Download and install Tor Browser After a successful installation, run Tor Browser and wait for its initialization. Type in the address bar: http://zvnvp2rhe3ljwf2m.onion Follow the instructions on the site.

URLs

http://zvnvp2rhe3ljwf2m.onion

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral25/memory/4220-0-0x0000000000400000-0x000000000058D000-memory.dmp	upx
behavioral25/memory/4220-2-0x0000000000400000-0x000000000058D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rokku.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3272	WMIC.exe
3272	WMIC.exe
3272	WMIC.exe
3272	WMIC.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3272	WMIC.exe
Token: SeSecurityPrivilege	3272	WMIC.exe
Token: SeTakeOwnershipPrivilege	3272	WMIC.exe
Token: SeLoadDriverPrivilege	3272	WMIC.exe
Token: SeSystemProfilePrivilege	3272	WMIC.exe
Token: SeSystemtimePrivilege	3272	WMIC.exe
Token: SeProfSingleProcessPrivilege	3272	WMIC.exe
Token: SeIncBasePriorityPrivilege	3272	WMIC.exe
Token: SeCreatePagefilePrivilege	3272	WMIC.exe
Token: SeBackupPrivilege	3272	WMIC.exe
Token: SeRestorePrivilege	3272	WMIC.exe
Token: SeShutdownPrivilege	3272	WMIC.exe
Token: SeDebugPrivilege	3272	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3272	WMIC.exe
Token: SeRemoteShutdownPrivilege	3272	WMIC.exe
Token: SeUndockPrivilege	3272	WMIC.exe
Token: SeManageVolumePrivilege	3272	WMIC.exe
Token: 33	3272	WMIC.exe
Token: 34	3272	WMIC.exe
Token: 35	3272	WMIC.exe
Token: 36	3272	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3272	WMIC.exe
Token: SeSecurityPrivilege	3272	WMIC.exe
Token: SeTakeOwnershipPrivilege	3272	WMIC.exe
Token: SeLoadDriverPrivilege	3272	WMIC.exe
Token: SeSystemProfilePrivilege	3272	WMIC.exe
Token: SeSystemtimePrivilege	3272	WMIC.exe
Token: SeProfSingleProcessPrivilege	3272	WMIC.exe
Token: SeIncBasePriorityPrivilege	3272	WMIC.exe
Token: SeCreatePagefilePrivilege	3272	WMIC.exe
Token: SeBackupPrivilege	3272	WMIC.exe
Token: SeRestorePrivilege	3272	WMIC.exe
Token: SeShutdownPrivilege	3272	WMIC.exe
Token: SeDebugPrivilege	3272	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3272	WMIC.exe
Token: SeRemoteShutdownPrivilege	3272	WMIC.exe
Token: SeUndockPrivilege	3272	WMIC.exe
Token: SeManageVolumePrivilege	3272	WMIC.exe
Token: 33	3272	WMIC.exe
Token: 34	3272	WMIC.exe
Token: 35	3272	WMIC.exe
Token: 36	3272	WMIC.exe
Token: SeBackupPrivilege	1060	vssvc.exe
Token: SeRestorePrivilege	1060	vssvc.exe
Token: SeAuditPrivilege	1060	vssvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3272	4220	Rokku.exe	89
PID 4220 wrote to memory of 3404	4220	Rokku.exe	91
PID 4220 wrote to memory of 5732	4220	Rokku.exe	93
PID 4220 wrote to memory of 4388	4220	Rokku.exe	95
PID 4220 wrote to memory of 4968	4220	Rokku.exe	97
PID 4388 wrote to memory of 1416	4388	net.exe	99
PID 4220 wrote to memory of 4680	4220	Rokku.exe	100
PID 4968 wrote to memory of 4948	4968	net.exe	103
PID 4680 wrote to memory of 1516	4680	net.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Ransomware\Rokku.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Rokku.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\services\VSS" /v Start /t REG_DWORD /d 4 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3404
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5732
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop vss
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop vss
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1416
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop swprv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop swprv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4948
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1516

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

README_HOW_TO_UNLOCK.HTML

Path C:\Recovery\WindowsRE\README_HOW_TO_UNLOCK.HTML
Size 1KB
SHA256 a7836550412b0e0963d16d8442b894a1148326b86d119e4d30f1b11956380ef0
MD5 c784d96ca311302c6f2f8f0bee8c725b
SHA1 dc68b518ce0eef4f519f9127769e3e3fa8edce46
SHA512 f97891dc3c3f15b9bc3446bc9d5913431f374aa54cced33d2082cf14d173a8178e29a8d9487c2a1ab87d2f6abf37e915f69f45c0d8b747ad3f17970645c35d98
TLSH
T13931A847BE30B0279447816DD5D2F1C8F176819981765E00B9CB800ABEE2FA4AB0F349
MD5 SHA1 SHA512 TLSH

Submit Download

README_HOW_TO_UNLOCK.TXT

Path C:\Recovery\WindowsRE\README_HOW_TO_UNLOCK.TXT
Size 330B
SHA256 eb22c6ecfd4d7d0fcea5063201ccf5e7313780e007ef47cca01f1369ee0e6be0
MD5 04b892b779d04f3a906fde1a904d98bb
SHA1 1a0d6cb6f921bc06ba9547a84b872ef61eb7e8a5
SHA512 e946aa4ac3ec9e5a178eac6f4c63a98f46bc85bed3efd6a53282d87aa56e53b4c11bb0d1c58c6c670f9f4ad9952b5e7fd1bb310a8bd7b5b04e7c607d1b74238a
TLSH
T1ECE07D4F2F3AB3F288B7D16A8059D4C1F778408F706604063C5F44105F39676860B6C5
MD5 SHA1 SHA512 TLSH

Submit Download

BackupPush.eps

Path C:\Users\Admin\Downloads\BackupPush.eps
Size 363KB
SHA256 def4a4ad4a4d25b9df47506936e0d3ea1ff5bb4b76eaab2ba8579eeadd099ac8
MD5 0a1e2338b7cf6832fa1be603ee9b2a7d
SHA1 56a2e86f585eb2b47b6630e6645e7b95978c7a5a
SHA512 6575a766e4a9b6f87a45f92d4aeeb5f956239b051c53447f2d6c68672a61f267a7d5378ffeaab957f31ef7b0689ae9e2c579ad59a5d4d2938d0dce4a76952800
SSDEEP 6144:P3q6N8y+B9VgQlKki5TtS6I549n9DM9K3EB589NeO3Un2mQCZO2ZQIv4PP0HC7wv:P66CX6ki/S6I54tygPee0s61wXJS
TLSH
T10884237AA3E942B2D3C2972B65E8F7BAC4879C905034130A52CFC7A4E5BC9CBC245F45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README_HOW_TO_UNLOCK.HTML

Path C:\Users\Admin\Downloads\README_HOW_TO_UNLOCK.HTML
Size 1KB
SHA256 a7836550412b0e0963d16d8442b894a1148326b86d119e4d30f1b11956380ef0
MD5 c784d96ca311302c6f2f8f0bee8c725b
SHA1 dc68b518ce0eef4f519f9127769e3e3fa8edce46
SHA512 f97891dc3c3f15b9bc3446bc9d5913431f374aa54cced33d2082cf14d173a8178e29a8d9487c2a1ab87d2f6abf37e915f69f45c0d8b747ad3f17970645c35d98
TLSH
T13931A847BE30B0279447816DD5D2F1C8F176819981765E00B9CB800ABEE2FA4AB0F349
MD5 SHA1 SHA512 TLSH

Submit Download

README_HOW_TO_UNLOCK.TXT

Path C:\Users\Admin\Downloads\README_HOW_TO_UNLOCK.TXT
Size 330B
SHA256 eb22c6ecfd4d7d0fcea5063201ccf5e7313780e007ef47cca01f1369ee0e6be0
MD5 04b892b779d04f3a906fde1a904d98bb
SHA1 1a0d6cb6f921bc06ba9547a84b872ef61eb7e8a5
SHA512 e946aa4ac3ec9e5a178eac6f4c63a98f46bc85bed3efd6a53282d87aa56e53b4c11bb0d1c58c6c670f9f4ad9952b5e7fd1bb310a8bd7b5b04e7c607d1b74238a
TLSH
T1ECE07D4F2F3AB3F288B7D16A8059D4C1F778408F706604063C5F44105F39676860B6C5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4220-0-0x0000000000400000-0x000000000058D000-memory.dmp

Download

memory/4220-1-0x000000000058C000-0x000000000058D000-memory.dmp

Download

memory/4220-2-0x0000000000400000-0x000000000058D000-memory.dmp

Download