General
- Target UXCryptor.exe
- Size 53KB
- Sample260704-tpwllsdw4k
- SHA256 32db249d49dc9c16b654a4caa779b4500abc98f141fd49ae5c49d9d1d0b0a87f
- MD5 3c55b1f7cc392e975aa66c85399ed559
- SHA1 412faead79457174645332246442a226e5cc7da9
- SHA512 081ff21afe26d58f521d3997fafd0075951820b47475bf750e2a4c874ee3a2f36d554248ce907da3e09fcb2b910abd3ce0df647095bac805c1a0695487448886
- SSDEEP 1536:PS/wZaQ1nWHKKft5fbbmXdnJb/8Y8cbwVcl:uwZqlJbbm5JbUHcbqY
- TLSH T19833F74133AD9B63F2BE56751931A28502F6E9122532CA6E3ECD51DD1AF3F0057227A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
UXCryptor.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
UXCryptor.exe
Resource
win11ltsc2024-20260629-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target UXCryptor.exe
- Size 53KB
- SHA256 32db249d49dc9c16b654a4caa779b4500abc98f141fd49ae5c49d9d1d0b0a87f
- MD5 3c55b1f7cc392e975aa66c85399ed559
- SHA1 412faead79457174645332246442a226e5cc7da9
- SHA512 081ff21afe26d58f521d3997fafd0075951820b47475bf750e2a4c874ee3a2f36d554248ce907da3e09fcb2b910abd3ce0df647095bac805c1a0695487448886
- SSDEEP 1536:PS/wZaQ1nWHKKft5fbbmXdnJb/8Y8cbwVcl:uwZqlJbbm5JbUHcbqY
- TLSH T19833F74133AD9B63F2BE56751931A28502F6E9122532CA6E3ECD51DD1AF3F0057227A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Disables RegEdit via registry modification
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
4