Overview

overview

10

Static

static

3

UXCryptor.exe

windows10-2004-x64

10

UXCryptor.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UXCryptor.exe
  • Size 143KB
  • Sample260804-qmk6baxycs
  • SHA256 95991a9843db900b207576c3475e82857fd5ff40af2207dba84d04ee3e3c0cae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • UAC bypass 3 TTPs 18 IoCs
    defense_evasiontrojan
  • Disables RegEdit via registry modification 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 24 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 36 IoCs
    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    defense_evasion
  • Views/modifies file attributes 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5552
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
          PID:5440
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:2480
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1028
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          PID:6108
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:3140
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5444
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:3728
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
            PID:1508
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:4988
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:2528
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:628
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            PID:756
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:4636
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:912
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Views/modifies file attributes
            PID:2844
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5744
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /f /im Explorer.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5876
      • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
        "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --init
        1⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Disables RegEdit via registry modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2324
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:5468
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:3836
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:4484
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:5880
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:5924
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:4636
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5852
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:2468
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:5744
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:1824
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:1300
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:5452
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:1564
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:3256
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
              PID:2744
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            PID:1420
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:5892
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • Views/modifies file attributes
              PID:3972
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /f /im Explorer.exe
            2⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:948
        • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
          "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
          1⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Disables RegEdit via registry modification
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4696
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            • System Location Discovery: System Language Discovery
            PID:4716
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • Views/modifies file attributes
              PID:6008
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:1300
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5936
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • Drops desktop.ini file(s)
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:1620
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:5272
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3216
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • Drops desktop.ini file(s)
              • Views/modifies file attributes
              PID:4164
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • Views/modifies file attributes
              PID:1948
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            • System Location Discovery: System Language Discovery
            PID:3288
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • Drops desktop.ini file(s)
              PID:5628
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • Views/modifies file attributes
              PID:4676
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            • System Location Discovery: System Language Discovery
            PID:2916
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • Drops desktop.ini file(s)
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:5732
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • Views/modifies file attributes
              PID:4760
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            • System Location Discovery: System Language Discovery
            PID:1608
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:4356
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:5356
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /f /im Explorer.exe
            2⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1180
        • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
          "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --wininit
          1⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Disables RegEdit via registry modification
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:5040
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            PID:5776
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
                PID:2744
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:5876
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • System Location Discovery: System Language Discovery
              PID:4876
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • Drops desktop.ini file(s)
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:4592
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • Views/modifies file attributes
                PID:560
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:2052
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                3⤵
                  PID:2844
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:624
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:4896
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:3628
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • Drops desktop.ini file(s)
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:6128
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • Views/modifies file attributes
                  PID:4752
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                • System Location Discovery: System Language Discovery
                PID:5792
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  3⤵
                    PID:2528
                  • C:\Windows\SysWOW64\attrib.exe
                    attrib +h +s +r +i /D
                    3⤵
                    • Drops desktop.ini file(s)
                    • System Location Discovery: System Language Discovery
                    • Views/modifies file attributes
                    PID:4268
                  • C:\Windows\SysWOW64\attrib.exe
                    attrib -h +s +r info-Locker.txt
                    3⤵
                    • Views/modifies file attributes
                    PID:1396
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • System Location Discovery: System Language Discovery
                  PID:3508
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    3⤵
                      PID:6108
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:2296
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • Views/modifies file attributes
                      PID:5036
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill.exe /f /im Explorer.exe
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5788
                • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
                  "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /setup
                  1⤵
                  • Modifies WinLogon for persistence
                  • UAC bypass
                  • Disables RegEdit via registry modification
                  • Adds Run key to start application
                  • Checks whether UAC is enabled
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:5728
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3632
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • Views/modifies file attributes
                      PID:4532
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • Views/modifies file attributes
                      PID:4636
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    PID:4768
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • Drops desktop.ini file(s)
                      • Views/modifies file attributes
                      PID:1436
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • Views/modifies file attributes
                      PID:5452
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    PID:5404
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • Drops desktop.ini file(s)
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:4360
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:5888
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    • Suspicious use of WriteProcessMemory
                    PID:1976
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • Drops desktop.ini file(s)
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:2448
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:5960
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    • System Location Discovery: System Language Discovery
                    PID:5300
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • Drops desktop.ini file(s)
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:2952
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • Views/modifies file attributes
                      PID:3432
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    PID:5344
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:2124
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:4532
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill.exe /f /im Explorer.exe
                    2⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5340
                • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
                  "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" -startup
                  1⤵
                  • Modifies WinLogon for persistence
                  • UAC bypass
                  • Disables RegEdit via registry modification
                  • Adds Run key to start application
                  • Checks whether UAC is enabled
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:5568
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    PID:1928
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:4288
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:6128
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    PID:4932
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • Drops desktop.ini file(s)
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:4972
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:5812
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    • System Location Discovery: System Language Discovery
                    PID:4084
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • Drops desktop.ini file(s)
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:3328
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:5744
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    PID:5308
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • Drops desktop.ini file(s)
                      • Views/modifies file attributes
                      PID:1160
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:1828
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    • System Location Discovery: System Language Discovery
                    PID:5364
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • Drops desktop.ini file(s)
                      • Views/modifies file attributes
                      PID:5356
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:2424
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    PID:1172
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +h +s +r +i /D
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:5944
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib -h +s +r info-Locker.txt
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Views/modifies file attributes
                      PID:2356
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill.exe /f /im Explorer.exe
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5324

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Winlogon Helper DLL

                      1
                      T1547.004

                      Privilege Escalation

                      Abuse Elevation Control Mechanism

                      1
                      T1548

                      Bypass User Account Control

                      1
                      T1548.002

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Winlogon Helper DLL

                      1
                      T1547.004

                      Defense Evasion

                      Abuse Elevation Control Mechanism

                      1
                      T1548

                      Bypass User Account Control

                      1
                      T1548.002

                      Hide Artifacts

                      2
                      T1564

                      Hidden Files and Directories

                      2
                      T1564.001

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify Tools

                      1
                      T1562.001

                      Modify Registry

                      4
                      T1112

                      Credential Access

                      Discovery

                      System Information Discovery

                      1
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      info-Locker.txt
                      • Path C:\Users\Admin\Desktop\info-Locker.txt
                      • Size 107B
                      • SHA256 3e030dfebbf8f02fba505a9f228d6f772baee7f4a5800127df563db5b818d9be
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/5552-0-0x0000000074D02000-0x0000000074D03000-memory.dmp
                      Download

                      memory/5552-1-0x0000000000CF0000-0x0000000000D1A000-memory.dmp
                      Download

                      memory/5552-2-0x00000000057F0000-0x000000000588C000-memory.dmp
                      Download

                      memory/5552-3-0x0000000005ED0000-0x000000000648A000-memory.dmp
                      Download

                      memory/5552-4-0x00000000059B0000-0x0000000005A42000-memory.dmp
                      Download

                      memory/5552-5-0x00000000058D0000-0x00000000058DA000-memory.dmp
                      Download

                      memory/5552-7-0x0000000074CF0000-0x00000000754AC000-memory.dmp
                      Download

                      memory/5552-6-0x0000000005A50000-0x0000000005AA6000-memory.dmp
                      Download

                      memory/5552-8-0x0000000005E40000-0x0000000005EA6000-memory.dmp
                      Download

                      memory/5552-22-0x0000000074D02000-0x0000000074D03000-memory.dmp
                      Download

                      memory/5552-23-0x0000000074CF0000-0x00000000754AC000-memory.dmp
                      Download