Dynamic analysis: run 2, cipher, mode and layout validation

Setup

• After the snapshot revert. Image base 0x7FF7EEBE0000. Ghidra MCP was briefly unreachable (ECONNREFUSED 192.168.36.130:8081), so x64dbg’s disassembler covered static lookups until it reconnected.
• Same zero-filled test files recreated with savedata.
• Launch: init "<exe>", "--encryption_path=C:\Users\deadtrace\Desktop\samples -localonly", "<cwd>".
• Breakpoints (static addresses):
  • 0x140073950 root-folder queue gate: check r8 (std::wstring root) before anything is encrypted;
  • 0x140071620 WMI executor, forced return;
  • 0x14007b0b0 / 0x14007b1a0 / 0x14007b4e0 / 0x14007b610 cipher init and use;
  • 0x14007b8d0 RSA encrypt (shows each file’s mode, percent and size);
  • kernelbase:SetFileInformationByHandle (rename);
  • 0x14003f880 async read: a logging breakpoint, then a conditional one on Part-stripe offsets (r9 in the gaps, or == 0x57E40 / 0xAFC80 / 0x107AC0, or ≥ 0x150EA0);
  • 0x1400397a0 async write with rdx==0x2DC6C0 (footer at original size).

Execution timeline

| Time | Event | Observation | |—|—|—| | 12:24 | WMI executor hit | forced return again | | 12:25 | gate hit | the only root queued is C:\Users\deadtrace\Desktop\samples; gate left armed | | 12:26 | file A, first chunk | 64 B of KCipher-2 keystream match the Python model with the captured key2/iv2 | | 12:27 | file A, chunk 2 | ChaCha keystream matches only the 128-bit-key, 8-round variant (6 variants tested); state shows “expand 16-byte k”, the key half twice, counter 0x400 at chunk 3 | | 12:28–29 | other folder files | pre-existing samples (the sample’s .zip, stage2.exe.malz, stage2.rar) encrypted, mode 1 | | 12:29 | zero_big.bin | RSA blob gives mode 2 Part, size 0x2DC6C0 | | 12:29 | zero_db.sqlite | mode 0 Full, percent 0, size 0x30000 | | 12:30 | Part stripe read | stripe 2 starts at 360,000 (0x57E40), 0xFFFF reads; nothing read in the 300,000–360,000 gap; past-the-end check never fired | | 12:30 | zero_small.txt | mode 1 Spot, 50%, size 0x3000 | | 12:31 | footer write | at offset 0x2DC6C0 (original size), length 0x200 | | 12:31 | ransom note | FUN_140042420 writes akira_readme.txt from 0x1400ef060 | | 12:32 | run finished | debuggee terminated; snapshot revert requested |

Memory / register observations

• The cipher states carry on across chunks; ChaCha discards the partial block at each 0xFFFF chunk.
• The mode byte in the 91-byte blob matched the predicted mode for every test file.

Network behaviour

• None.

Host behaviour

• Encryption stayed inside the samples folder: the gate confirmed it before any file was touched. Everything in that folder was encrypted, including other samples. A note and a log were written.

Conclusions

• ChaCha8 (128-bit key), KCipher-2, the three modes, the Part stripe layout and the footer placement are all confirmed against live data.