General
- Target UXCryptor.exe
- Size 115KB
- Sample260721-askhzab15v
- SHA256 8e3c4081475aa4d87fe71a982b9e859ffd4651354f4b1b55067a3005cf5b876c
- MD5 b77acf300b67808c2c62c089f7c0b0d9
- SHA1 72b7654f5c92f88ce6e5f0e603a9e16be3e63c5e
- SHA512 af301d50dca3afee850314bc8344a7f37a122e228df895103f64bdb2770f43531cfc3c1347345555f098112c0825ff7faeda59ff8e6fc115153c7c6567ea4ff1
- SSDEEP 3072:xWrLCNh4nbbtgSbtX2ydjY4mXy9zUdv00gVOnx/P/ZuKqY:6btXfSEzwvqwx/Pjq
- TLSH T12CC3AF0577D28624E27E6B370573E65007FBA9068237DF1D3DCE65A91BA3B408B22B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
UXCryptor.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
UXCryptor.exe
Resource
win11ltsc2024-20260710-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target UXCryptor.exe
- Size 115KB
- SHA256 8e3c4081475aa4d87fe71a982b9e859ffd4651354f4b1b55067a3005cf5b876c
- MD5 b77acf300b67808c2c62c089f7c0b0d9
- SHA1 72b7654f5c92f88ce6e5f0e603a9e16be3e63c5e
- SHA512 af301d50dca3afee850314bc8344a7f37a122e228df895103f64bdb2770f43531cfc3c1347345555f098112c0825ff7faeda59ff8e6fc115153c7c6567ea4ff1
- SSDEEP 3072:xWrLCNh4nbbtgSbtX2ydjY4mXy9zUdv00gVOnx/P/ZuKqY:6btXfSEzwvqwx/Pjq
- TLSH T12CC3AF0577D28624E27E6B370573E65007FBA9068237DF1D3DCE65A91BA3B408B22B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Disables RegEdit via registry modification
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
4