006306a34e84f6e9d9f01f79f487088a26ac332a253a85fba6f5cd9ca28c9ea4

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lc.exe
Size 331KB
Sample260619-tap6aaaw3x
SHA256 006306a34e84f6e9d9f01f79f487088a26ac332a253a85fba6f5cd9ca28c9ea4
MD5 077340e7ee88a961dfbe771a68326e2d
SHA1 4f2cfc0636c756997c6737291b744eb3e4bb0a18
SHA512 e3857595bcc8f4039f9294d8d03d20bfd6345f4d9da0941bee976d140c213739d5b70a3f9b44e2420d35f5b23bbf3c4b41c9e6c1cee0a94ff3f72ef0855849cf
SSDEEP 6144:ta0UKTyosNpfSCpMW90KImQinnVbk6lEnQd/hwQBjrQi33v8U:ta0UKSNpjPpwu3v
TLSH
T13B74AE9033AA467AC55D82BEE055124E43F4A52AD573EB857C8806EC9F8733CD78C29F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lc.exe\""	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lc.exe\" -startup"	lc.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2416	cmd.exe
4256	cmd.exe
1620	cmd.exe
3404	cmd.exe
2936	cmd.exe
5764	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1468	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
6128	lc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6128	lc.exe
Token: SeDebugPrivilege	1468	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 2416	6128	lc.exe	90
PID 6128 wrote to memory of 5764	6128	lc.exe	91
PID 6128 wrote to memory of 2936	6128	lc.exe	92
PID 6128 wrote to memory of 3404	6128	lc.exe	93
PID 6128 wrote to memory of 1620	6128	lc.exe	94
PID 6128 wrote to memory of 4256	6128	lc.exe	95
PID 6128 wrote to memory of 1468	6128	lc.exe	96
PID 1620 wrote to memory of 6596	1620	cmd.exe	104
PID 2416 wrote to memory of 5272	2416	cmd.exe	105
PID 5764 wrote to memory of 3688	5764	cmd.exe	106
PID 4256 wrote to memory of 5920	4256	cmd.exe	107
PID 2936 wrote to memory of 2352	2936	cmd.exe	108
PID 3404 wrote to memory of 3492	3404	cmd.exe	109
PID 1620 wrote to memory of 4896	1620	cmd.exe	110
PID 2936 wrote to memory of 3420	2936	cmd.exe	111
PID 2416 wrote to memory of 6004	2416	cmd.exe	113
PID 4256 wrote to memory of 6908	4256	cmd.exe	112
PID 5764 wrote to memory of 6980	5764	cmd.exe	114
PID 3404 wrote to memory of 6816	3404	cmd.exe	115

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6596	attrib.exe
3688	attrib.exe
3420	attrib.exe
6004	attrib.exe
6980	attrib.exe
6908	attrib.exe
5272	attrib.exe
2352	attrib.exe
5920	attrib.exe
3492	attrib.exe
6816	attrib.exe
4896	attrib.exe

C:\Users\Admin\AppData\Local\Temp\lc.exe
"C:\Users\Admin\AppData\Local\Temp\lc.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @uglytyph 1>info-0v92.txt & attrib -h +s +r lc.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5272
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r lc.txt
    3⤵
    - Views/modifies file attributes
    PID:6004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @uglytyph 1>info-0v92.txt & attrib -h +s +r lc.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3688
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r lc.txt
    3⤵
    - Views/modifies file attributes
    PID:6980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @uglytyph 1>info-0v92.txt & attrib -h +s +r lc.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2352
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r lc.txt
    3⤵
    - Views/modifies file attributes
    PID:3420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @uglytyph 1>info-0v92.txt & attrib -h +s +r lc.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3492
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r lc.txt
    3⤵
    - Views/modifies file attributes
    PID:6816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @uglytyph 1>info-0v92.txt & attrib -h +s +r lc.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:6596
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r lc.txt
    3⤵
    - Views/modifies file attributes
    PID:4896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @uglytyph 1>info-0v92.txt & attrib -h +s +r lc.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5920
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r lc.txt
    3⤵
    - Views/modifies file attributes
    PID:6908
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-0v92.txt

Path C:\Users\Admin\Desktop\info-0v92.txt
Size 107B
SHA256 ee86a09ce9cc70cb0390f81428fd2339b22073889200466ff03db28c4ed41cdc
MD5 5a76e6dfed59a6cc66d0f8af7fdc2476
SHA1 267be1b017aa809f5f71dd5c9f784d829b83f427
SHA512 99b647709f326df0f3ea898e19c1e13e9676babee0447195a6f41c1f5204daf26a3e453fc9793d08d5c38123887fa6131550ead703d5415dd34a4626a2a5d95d
TLSH
T1BEB024041D7CF3C410D000F03133F150345DD30D503305401104005500344FC5DD70F0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6128-11-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-12-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-3-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-0-0x00007FFFA6EDF000-0x00007FFFA6EE0000-memory.dmp

Download

memory/6128-5-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-6-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-8-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-9-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-2-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-10-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-4-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-1-0x0000000000580000-0x00000000005DA000-memory.dmp

Download

memory/6128-13-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-20-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-21-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-22-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-23-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-24-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download

memory/6128-25-0x00007FFFA6D50000-0x00007FFFA76F4000-memory.dmp

Download