08ca0ed00af089d8fe64c3532a09699d6f3d1b7088f65cc3b1e6384ca73cca8a

Analysis

user interaction
yes
max time kernel
208s
max time network
184s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/06/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hgvcuj.exe
Size 97KB
Sample260623-wevbxaex2m
SHA256 08ca0ed00af089d8fe64c3532a09699d6f3d1b7088f65cc3b1e6384ca73cca8a
MD5 b6c6a5489bf8b63befe4e0585243cba6
SHA1 7ceca8a58658eae72179d6714d96d030077fe428
SHA512 66bce911899e7c68f979fea6f1ef40b71e6928e63ba9c9e79c47e081bec451f7c9160a4df358332441d204dcca6e6165f19d68f46e69f8a4fe861f8269d61c34
SSDEEP 1536:86vGQ41+nJWVx9D1y29G3z4b+etBnw+wJSfI2ArfCWVcnWJgrZopa:86vG4qx9D104bDt1whJKPAjCVo
TLSH
T1F6A34D2AAA5A40EBD269C97CCE534906D7B3BC814761B3CF67910DD60E367D49F3A302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery exploit ransomware

Malware Config

Signatures

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hgvcuj.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hgvcuj.exe

Disables Task Manager via registry modification
defense_evasion

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1588	takeown.exe
4432	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1588	takeown.exe
4432	icacls.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\LogonUI.exe	xcopy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5676	notepad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	hgvcuj.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1588	takeown.exe
Token: 33	5644	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5644	AUDIODG.EXE
Token: SeShutdownPrivilege	2724	hgvcuj.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe
2724	hgvcuj.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3196	2724	hgvcuj.exe	80
PID 3196 wrote to memory of 1588	3196	cmd.exe	82
PID 3196 wrote to memory of 4432	3196	cmd.exe	83
PID 3196 wrote to memory of 4652	3196	cmd.exe	84
PID 2724 wrote to memory of 5676	2724	hgvcuj.exe	85

System policy modification 1 TTPs 5 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	hgvcuj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	hgvcuj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	hgvcuj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	hgvcuj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hgvcuj.exe

C:\Users\Admin\AppData\Local\Temp\hgvcuj.exe
"C:\Users\Admin\AppData\Local\Temp\hgvcuj.exe"
1⤵
- Disables RegEdit via registry modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f "C:\Windows\System32\LogonUI.exe" && icacls "C:\Windows\System32\LogonUI.exe" /grant "Admin":F && xcopy "C:\Users\Admin\AppData\Local\Temp\hgvcujlogon.exe" "C:\Windows\System32\LogonUI.exe" /Y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\LogonUI.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\LogonUI.exe" /grant "Admin":F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4432
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\hgvcujlogon.exe" "C:\Windows\System32\LogonUI.exe" /Y
    3⤵
    - Drops file in System32 directory
    PID:4652
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\hgvcuj.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hgvcuj.txt

Path C:\Users\Admin\AppData\Local\Temp\hgvcuj.txt
Size 6B
SHA256 725b5eb6d60d4bc774ff5011b66693f0d479bc48d0c8c68138edfc6b3e5fd81a
MD5 a8016494b013f639144c65ce8e79ec81
SHA1 89d2a09e1e4b1415d5582510e1031ff33fba04bc
SHA512 ad1c16695aeb5abb82b9bc74ecc532a21e822f5dd69a9aa8d067a0b26993c78d36b20e11539592627c8c88013ba5d844b2b348277f2329d903233dfc18bde26f
MD5 SHA1 SHA512

Submit Download

hgvcujlogon.exe

Path C:\Users\Admin\AppData\Local\Temp\hgvcujlogon.exe
Size 17KB
SHA256 41b79f9e0146d3b2cfd14831067bbfbcf3c5652713061cff630178cbc79556bc
MD5 87bdca5ac8e84014c0129ca5fc94ba46
SHA1 33b8f58d8b55861f7ae1998de77920e8c0548469
SHA512 72f8440f92c4330bdca1403088f52f4039d21c4c8f776675fb04ce63d0c2283036267db068c972aaad730ddf7114f18878f96523ba265f3a6269dcbd7860d92a
SSDEEP 192:GYh+rEv5ne6CvnbA3gP0teg1DHXu6YF+ikpvIj0GG2Y1055X9gG:GYcrSelA3gmLtu6meWM01
TLSH
T14B723A8EBBA145EDE176C1388D635A29E172B5914723A3CF53B00A1E0E56BC4ED33B49
MD5 SHA1 SHA512 SSDEEP TLSH