Dynamic analysis: run 1, first detonation and key-generation capture

Setup

• Tooling: x64dbg MCP (live), Ghidra MCP for static lookups. Times are UTC, 2026-10-11.
• Image base 0x7FF7D6070000 (rebase = static − 0x140000000 + base).
• Test files written into C:\Users\deadtrace\Desktop\samples with x64dbg savedata from a zeroed allocation: zero_small.txt (0x3000), zero_db.sqlite (0x30000), zero_big.bin (0x2DC6C0). Zero-filled plaintext makes ciphertext equal to keystream.
• Launch:
  • LoadBinary with arguments didn’t reach the PEB command line.
  • The native command worked: init "<exe>", "-p C:\Users\deadtrace\Desktop\samples", "<cwd>".
• Breakpoints (static addresses):
  • 0x14004ca40 main;
  • 0x140071620 WMI executor, forced return with rax=0; rip=[rsp]; rsp=rsp+8;
  • 0x1400822c0 Yarrow seed;
  • 0x14007b0b0 ChaCha init;
  • 0x14007b4e0 KCipher-2 init;
  • 0x14007b8d0 RSA encrypt. The crypto breakpoints were later made conditional with bpcond …, "tid()==0x444".
• Anti-analysis workarounds: none needed. The sample reached main normally under the debugger.

Execution timeline

| Time | Event | Observation | |—|—|—| | 11:48 | LoadBinary with args | args missing from PEB; relaunched with init | | 11:49 | reached main | no anti-debug | | 11:50 | WMI executor hit | decoded command confirmed in memory; call skipped (shadow copies kept) | | 11:50 | first Yarrow seed hit | seed "867151895800", thread 0x444, return into FUN_14007b1f0, so this is key1 | | 11:51 | second encryptor thread 0x164C | hits interleaved; breakpoints restricted to tid 0x444 | | 11:51 | four seeds for thread 0x444 | key1 867151895800, iv1 882441766800, key2 894629870400, iv2 936082862900 | | 11:52–53 | RSA encrypt hit | 91-byte plaintext blob captured; Python regenerated all its key bytes from the four seeds | | 11:54 | escape noticed | real files on C: renamed .akira (for example C:\Program Files\010 Editor\010Editor.news); debuggee killed; snapshot revert requested |

Memory / register observations

• Seed strings are 12–13 decimal digits, equal to QPC × 100 (ns of uptime on a 10 MHz QPC).
• Each of the four values per file has its own Yarrow instance, so four seed hits make one file.

Network behaviour

• None.

Host behaviour

• With no usable path argument the sample swept all drives (no -localonly), encrypting outside the samples folder.

Conclusions

• Root cause of the escape: the argh-style parser needs --encryption_path=<path>. -p <path> is a bare flag and gives an empty path, so the sample falls back to the drive sweep.
• Mitigation used in later runs: --encryption_path=<samples> -localonly, plus a gate breakpoint on the root-folder queue (FUN_140073950) to check r8 before resuming.
• The key-generation weakness (QPC-only Yarrow seeds) was confirmed here.