EXECryptor V2X SoftComplete Developement

Hunt Hypothesis

This hypothesis targets the presence of the EXECryptor V2X SoftComplete development build, a specific variant of the EXECryptor ransomware family often used for initial encryption operations or testing. Proactively hunting for this signature allows the SOC to identify early-stage ransomware activity or developer artifacts before they progress to widespread encryption, mitigating potential data loss in the Azure environment.

YARA Rule

rule EXECryptor_V2X_SoftComplete_Developement: PEiD
{
    strings:
        $a = { A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Framework Development on Build Agents: Developers compiling custom .NET 4.x applications using older versions of Visual Studio (e.g., VS 2017/2019) or MSBuild on dedicated build servers often trigger this rule due to the presence of specific soft-complete development markers in the PE header or resource sections.
  • Filter/Exclusion: Exclude files located in standard build directories (e.g., C:\BuildAgents\, D:\CI\) or exclude processes named MSBuild.exe and vstest.console.exe when the parent process is dotnet.exe or msbuild.exe.
• Internal Tooling Compiled with Roslyn: Internal utility scripts or small administrative tools compiled directly via the Roslyn compiler (csc.exe) or dotnet build for quick admin tasks may retain development-specific metadata that matches the YARA signature.
  • Filter/Exclusion: Exclude executables in the user’s local AppData\Local\Temp or specific internal tool directories (e.g., C:\Tools\InternalUtils\) if the file age is less than 7 days and the size is under 5MB.
• Scheduled Maintenance Jobs Using Old .NET Apps: Scheduled tasks (e.g., Task Scheduler jobs) that run legacy .NET console applications for log rotation, database backups, or report generation can trigger the rule if the binary was compiled in a development environment and not fully stripped of debug symbols.
  • Filter/Exclusion: Exclude processes spawned by schtasks.exe or Task Scheduler service if the executable path contains keywords like maintenance, backup, or report and the parent process is svchost.exe (specifically the Schedule service).
• Test Automation Frameworks (Selenium/Playwright): QA teams running automated