14d9c2d2a3846eaf856f7dc378df8a587f10f2702c36e00b90e92e5ac570e17f

Resubmissions

28/04/2026, 01:52

260428-calpescv518

28/04/2026, 01:41

28/04/2026, 01:37

28/04/2026, 01:32

28/04/2026, 01:28

28/04/2026, 01:22

28/04/2026, 01:12

Analysis

user interaction
yes
max time kernel
62s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gi9trtiw0n0whtld.exe
Size 671KB
Sample260428-b2cedsct21
SHA256 14d9c2d2a3846eaf856f7dc378df8a587f10f2702c36e00b90e92e5ac570e17f
MD5 9bd5d9a4e09ec3cc6ea55e6600e947b2
SHA1 3580723355ada3145e12a4efc5f9f6346b536639
SHA512 97f0b520f4dc8b1e221c7c2524293517065455d1d443976bb2d6bd19f0f10d7a7a407b6b93761bdad2be045b130949b18159a91f30f0ebe1c6c67ce6da3b05d0
SSDEEP 12288:vg1vyh0EGwp3I+q/Vrh4iV7kSnx8PMrSKfWDfpofv3wl6vXbXPH+:I1vs0Q4lUi6Snx8WSKfWDfpofvWO7H
TLSH
T10CE407042FE79E10E244267D801FD30487718BE19383774B371AF6B4696A6EE8F4E5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2872.tmp.exe\""	tmp2872.tmp.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	gi9trtiw0n0whtld.exe

Executes dropped EXE 6 IoCs

pid	Process
4592	tmp2872.tmp.exe
2080	tmp2872.tmp.exe
5140	tmp2872.tmp.exe
3780	tmp2872.tmp.exe
5160	tmp2872.tmp.exe
5852	tmp2872.tmp.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2872.tmp.exe\" -startup"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2872.tmp.exe\" --init"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2872.tmp.exe\""	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2872.tmp.exe\" /setup"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2872.tmp.exe\" --wininit"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	tmp2872.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	tmp2872.tmp.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2752	powershell.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3964	cmd.exe
3444	cmd.exe
4228	cmd.exe
812	cmd.exe
3972	cmd.exe
2560	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
568	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2752	powershell.exe
2752	powershell.exe
4592	tmp2872.tmp.exe
4592	tmp2872.tmp.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	gi9trtiw0n0whtld.exe
Token: SeIncBasePriorityPrivilege	3576	gi9trtiw0n0whtld.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	4592	tmp2872.tmp.exe
Token: SeDebugPrivilege	568	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4676	3576	gi9trtiw0n0whtld.exe	93
PID 4676 wrote to memory of 2752	4676	cmd.exe	95
PID 2752 wrote to memory of 4592	2752	powershell.exe	96
PID 4592 wrote to memory of 3444	4592	tmp2872.tmp.exe	109
PID 4592 wrote to memory of 3964	4592	tmp2872.tmp.exe	110
PID 4592 wrote to memory of 2560	4592	tmp2872.tmp.exe	111
PID 4592 wrote to memory of 3972	4592	tmp2872.tmp.exe	112
PID 4592 wrote to memory of 812	4592	tmp2872.tmp.exe	113
PID 4592 wrote to memory of 4228	4592	tmp2872.tmp.exe	114
PID 4592 wrote to memory of 568	4592	tmp2872.tmp.exe	115
PID 3972 wrote to memory of 2388	3972	cmd.exe	127
PID 2560 wrote to memory of 5220	2560	cmd.exe	128
PID 4228 wrote to memory of 4784	4228	cmd.exe	129
PID 812 wrote to memory of 3820	812	cmd.exe	131
PID 3964 wrote to memory of 6104	3964	cmd.exe	132
PID 3444 wrote to memory of 6012	3444	cmd.exe	133
PID 3964 wrote to memory of 4008	3964	cmd.exe	134
PID 3444 wrote to memory of 2732	3444	cmd.exe	135
PID 812 wrote to memory of 3792	812	cmd.exe	138
PID 2560 wrote to memory of 452	2560	cmd.exe	139
PID 4228 wrote to memory of 5532	4228	cmd.exe	140
PID 3972 wrote to memory of 1632	3972	cmd.exe	141

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6012	attrib.exe
452	attrib.exe
4784	attrib.exe
6104	attrib.exe
4008	attrib.exe
2732	attrib.exe
3792	attrib.exe
5532	attrib.exe
1632	attrib.exe
2388	attrib.exe
5220	attrib.exe
3820	attrib.exe

C:\Users\Admin\AppData\Local\Temp\gi9trtiw0n0whtld.exe
"C:\Users\Admin\AppData\Local\Temp\gi9trtiw0n0whtld.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3444
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:6012
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:2732
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3964
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:6104
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:4008
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:2560
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:5220
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:452
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3972
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:2388
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:1632
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:812
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:3820
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:3792
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:4228
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:4784
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:5532
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill.exe /im Explorer.exe /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:568

C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe" --wininit
1⤵
- Executes dropped EXE
PID:2080

C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe" -startup
1⤵
- Executes dropped EXE
PID:5140

C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe" /setup
1⤵
- Executes dropped EXE
PID:3780

C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe" --init
1⤵
- Executes dropped EXE
PID:5160

C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe"
1⤵
- Executes dropped EXE
PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp2872.tmp.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\tmp2872.tmp.exe.log
Size 1KB
SHA256 c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
MD5 2d2a235f1b0f4b608c5910673735494b
SHA1 23a63f6529bfdf917886ab8347092238db0423a0
SHA512 10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086
TLSH
T1C031DE712372B1D889163F431C2D2AC007BF4769B660EE0C7598625ED9260175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mwgwizcd.qfn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mwgwizcd.qfn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp2872.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp2872.tmp.exe
Size 209KB
SHA256 821cc435a32ac240d47f9d44696f8a27b020d6412c25ee467d599a049ef1a55d
MD5 a6d3112e0b4d00af36e27a82b6f5fe4b
SHA1 a141119ad6d91455e305ec1812317ade64a834cc
SHA512 6e52b65ad9606785c7f55381677364315d06540a8f5440b5cda1cab641877c6ade34fa85345b1338de0ba77a922d55d420a27d0f58a3f7c7c68a508837c133be
SSDEEP 6144:zk8A/ehUOqx8PBHnRtQ0UyB97SCpMW90KImQijnCbdewO:znAwUOqx8PJjQY
TLSH
T1A5244A981397897DD67D237ED0A1120907F56223C503F34E9EE5E4F89E2B3129B22B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Desktop\info-Locker.txt
Size 71B
SHA256 ba0361c275e946e4f67398c587964bf200760783ddfc3288f0f47129a35f77a1
MD5 48509a1874790428881a1441043c5fd3
SHA1 2e504281b645f353ebc45ce8ba318fbc678c2ec2
SHA512 16ea76910a1b5b14b303f0d67457bd0c8f84f23f581672a3058597a840123763e15ae7e2ef9ccd129ab9615e0d6c885ad94258e3eb17890745e49cf685159f83
TLSH
T198A022C03C2C3288200232F33A32B2202CBEFC0CF0032880020220A300A00C83AEF8A0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2080-35-0x00000000012E0000-0x00000000012EC000-memory.dmp

Download

memory/2752-13-0x0000021D0B350000-0x0000021D0B360000-memory.dmp

Download

memory/2752-14-0x0000021D0B350000-0x0000021D0B360000-memory.dmp

Download

memory/2752-29-0x0000021D0B2F0000-0x0000021D0B2FC000-memory.dmp

Download

memory/2752-23-0x0000021D239E0000-0x0000021D23A02000-memory.dmp

Download

memory/3576-1-0x0000016960880000-0x0000016960890000-memory.dmp

Download

memory/3576-5-0x0000016960DB0000-0x0000016960E7A000-memory.dmp

Download

memory/3576-11-0x0000016960CE0000-0x0000016960CEC000-memory.dmp

Download

memory/3576-0-0x0000016946250000-0x00000169462FC000-memory.dmp

Download

memory/3576-7-0x0000016960880000-0x0000016960890000-memory.dmp

Download

memory/3576-10-0x0000016960880000-0x0000016960890000-memory.dmp

Download

memory/3576-6-0x0000016960880000-0x0000016960890000-memory.dmp

Download

memory/3576-8-0x00000169466E0000-0x00000169466EC000-memory.dmp

Download

memory/3576-9-0x0000016960880000-0x0000016960890000-memory.dmp

Download

memory/3576-15-0x0000016960880000-0x0000016960890000-memory.dmp

Download

memory/3576-4-0x0000016960880000-0x0000016960890000-memory.dmp

Download

memory/3780-43-0x0000000002ED0000-0x0000000002EDC000-memory.dmp

Download

memory/4592-28-0x0000000000C40000-0x0000000000C7A000-memory.dmp

Download

memory/4592-58-0x0000000001420000-0x000000000142C000-memory.dmp

Download

memory/5140-39-0x0000000002790000-0x000000000279C000-memory.dmp

Download

memory/5160-53-0x0000000002230000-0x000000000223C000-memory.dmp

Download

memory/5852-51-0x0000000000C30000-0x0000000000C3C000-memory.dmp

Download