Overview

overview

8

Static

static

3

Encryptor_...03.exe

windows10-2004-x64

8

Encryptor_...03.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 11:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Encryptor_ZXZXXZZX_d98d03.exe
  • Size 6.0MB
  • Sample260622-m5ppnsbw8x
  • SHA256 7872a6871230edf75b1d39d9a0235c3803aec7a632ea32172fd406a48e3109dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecredential_accessdefense_evasiondiscoverypersistencespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 54 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Modifies registry class 6 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Encryptor_ZXZXXZZX_d98d03.exe
    "C:\Users\Admin\AppData\Local\Temp\Encryptor_ZXZXXZZX_d98d03.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\vault_locked_icon.ico
      2⤵
      • Views/modifies file attributes
      PID:932
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "reg add HKCU\Software\Classes\.LOCKED /ve /d VaultBuilderLockedFile /f"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5624
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Classes\.LOCKED /ve /d VaultBuilderLockedFile /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:5756
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "reg add HKCU\Software\Classes\VaultBuilderLockedFile\DefaultIcon /ve /d \"C:\Users\Admin\AppData\Local\Temp\vault_locked_icon.ico\" /f"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3596
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Classes\VaultBuilderLockedFile\DefaultIcon /ve /d \"C:\Users\Admin\AppData\Local\Temp\vault_locked_icon.ico\" /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:1576
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "ie4uinit.exe -show"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3912
      • C:\Windows\system32\ie4uinit.exe
        ie4uinit.exe -show
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:1244
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\melt.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Windows\system32\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1720

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Active Setup

        1
        T1547.014

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Active Setup

        1
        T1547.014

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Modify Registry

        3
        T1112

        Credential Access

        Credentials from Password Stores

        2
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Windows Credential Manager

        1
        T1555.004

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Remote System Discovery

        1
        T1018

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
        • Size 2KB
        • SHA256 efaa43be4eeea4c13e862aca4e133e7f5b8fee4287aad2442db0ef6b51c066aa
        • MD5 SHA1 SHA512
        Submit Download

        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
        • Size 471B
        • SHA256 9d2ce1c032646d2a3381b68bc9201e3dcd53b764e83a0d356d67cc4926ece015
        • MD5 SHA1 SHA512
        Submit Download

        UserCache.bin
        • Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin
        • Size 29KB
        • SHA256 fe911e87c10d15c7176d4baf92505ef72fa3d68fd2da0c81f23e2dd034c08204
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sadc.txt
        • Path C:\Users\Admin\AppData\Local\Adobe\Color\sadc.txt
        • Size 4B
        • SHA256 ab475f6db13df1bbeac302df1fafa736b02f9630c4714dcf4b7d62247285b01e
        • MD5 SHA1 SHA512
        Submit Download

        CURRENT
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT
        • Size 16B
        • SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
        • MD5 SHA1 SHA512
        Submit Download

        MANIFEST-000001
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001
        • Size 41B
        • SHA256 9e1736c43d19118e6ce4302118af337109491ecc52757dfb949bad6a7940b0c2
        • MD5 SHA1 SHA512
        Submit Download

        6eb6c21622981eb3_0
        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6eb6c21622981eb3_0
        • Size 279B
        • SHA256 74ca16b1138459ef2afb19324097332626ee7c897687c5adc5488f93bf0c11ff
        • MD5 SHA1 SHA512
        Submit Download

        ef6a98bdd79fdeff_0
        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ef6a98bdd79fdeff_0
        • Size 380B
        • SHA256 08c3e5bbea4fba57201a69d4bf70a0d255df921fdef4924c22da087f9338c2bc
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index
        • Size 24B
        • SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
        • MD5 SHA1 SHA512
        Submit Download

        PreferredApps
        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
        • Size 33B
        • SHA256 7f9c9e31ac8256ca2f258583df262dbc7d6f68f2a03043d5c99a4ae5a7396ce9
        • MD5 SHA1 SHA512
        Submit Download

        the-real-index
        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
        • Size 48B
        • SHA256 17b0761f87b081d5cf10757ccc89f12be355c70e2e29df288b65b30710dcbcd1
        • MD5 SHA1 SHA512
        Submit Download

        OneDriveMedTile.scale-125.png
        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png
        • Size 848B
        • SHA256 4925b9b6329f24346bce043f2cdabb940199fd87188f3ae77c9559bf7cfa9f43
        • MD5 SHA1 SHA512
        Submit Download

        social-track-digest256.sbstore
        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c1sxuejy.default-release\safebrowsing\social-track-digest256.sbstore
        • Size 298B
        • SHA256 314f47cf9b9e4e05c5e965e82dd2751a934c094b481a00291e9e11f21d0ec4ee
        • MD5 SHA1 SHA512
        Submit Download

        melt.bat
        • Path C:\Users\Admin\AppData\Local\Temp\melt.bat
        • Size 128B
        • SHA256 86de9b9e551a82e929e136631fea17f2cbdc2f9e536f48b92afbc7fdc6ecc73d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vault_locked_icon.ico
        • Path C:\Users\Admin\AppData\Local\Temp\vault_locked_icon.ico
        • Size 135KB
        • SHA256 61a6327a56671eb2ef12fa3efd561a1dc5666c1e09c382b154799c70539e86b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default.acl
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acl
        • Size 2B
        • SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
        • MD5 SHA1 SHA512
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
        • Size 174B
        • SHA256 eaae98aa73fe0b561c8b02607a524fb4853bbe81c6de8c3d8a9b7449366809d4
        • MD5 SHA1 SHA512
        Submit Download

        3 - Windows Explorer.lnk
        • Path C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
        • Size 1KB
        • SHA256 462fa5c6568794276673c9159500918afddf8f170e580fd1f3d483c48934b050
        • MD5 SHA1 SHA512
        Submit Download

        03 - Computer Management.lnk
        • Path C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
        • Size 1015B
        • SHA256 1f9ec15f6ff239e14a3a243a98f19ae7db16d425a63b2da0908cc0ffcb1258e7
        • MD5 SHA1 SHA512
        Submit Download

        Desktop.ini
        • Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
        • Size 170B
        • SHA256 d07bdfd8af965e4283a5f77274fc59bee1379af9f221358b81099df31f696345
        • MD5 SHA1 SHA512
        Submit Download