Overview

overview

10

Static

static

3

UXCryptor.exe

windows10-2004-x64

10

UXCryptor.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 16:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UXCryptor.exe
  • Size 955KB
  • Sample260809-tnnvdat1ay
  • SHA256 006bf2afe80ac82b2a164c60f7612652c29f65fd4c1ab08e273b4d1f19617b58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • UAC bypass 3 TTPs 18 IoCs
    defense_evasiontrojan
  • Disables RegEdit via registry modification 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 24 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 36 IoCs
    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    defense_evasion
  • Views/modifies file attributes 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1316
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:584
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:1728
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:4016
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:4196
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5112
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4360
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:2132
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:2892
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3080
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3988
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:968
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:4500
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3444
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Views/modifies file attributes
        PID:3624
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:3980
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im Explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2488
  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --wininit
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:952
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Views/modifies file attributes
        PID:1276
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:5396
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:2084
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:5772
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:3440
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4040
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:5360
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        PID:5180
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5860
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5236
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:5896
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5216
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5556
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im Explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3044
  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:372
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4320
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Views/modifies file attributes
        PID:4292
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5872
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:3608
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5792
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      PID:2632
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5344
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5588
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      PID:3984
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:5336
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5916
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:3724
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:3408
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
          PID:5800
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:2884
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Views/modifies file attributes
          PID:5328
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5908
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im Explorer.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4340
    • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
      "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" -startup
      1⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Disables RegEdit via registry modification
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3616
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:1456
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5264
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5580
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:3776
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:5440
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:5972
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:3784
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:5404
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:5948
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:3248
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5456
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:5776
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:2528
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:5388
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:5956
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:4372
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Views/modifies file attributes
          PID:5432
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
            PID:5964
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /f /im Explorer.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1248
      • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
        "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --init
        1⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Disables RegEdit via registry modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:748
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:3744
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Views/modifies file attributes
            PID:5568
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:6012
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:4616
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5296
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:5692
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:4504
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:5448
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5736
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:1064
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:5320
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:5684
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:2316
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:5464
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
              PID:5756
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
            2⤵
            • Hide Artifacts: Hidden Files and Directories
            PID:4276
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h +s +r +i /D
              3⤵
              • Views/modifies file attributes
              PID:5476
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h +s +r info-Locker.txt
              3⤵
                PID:5984
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /f /im Explorer.exe
              2⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1712
          • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
            "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /setup
            1⤵
            • Modifies WinLogon for persistence
            • UAC bypass
            • Disables RegEdit via registry modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1160
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              PID:4640
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:5656
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:6056
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • System Location Discovery: System Language Discovery
              PID:2972
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • Drops desktop.ini file(s)
                • Views/modifies file attributes
                PID:5672
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:6040
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              PID:2160
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s +r +i /D
                3⤵
                • Drops desktop.ini file(s)
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:5664
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h +s +r info-Locker.txt
                3⤵
                  PID:6064
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                • System Location Discovery: System Language Discovery
                PID:3688
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • Drops desktop.ini file(s)
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:5712
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:5808
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                • System Location Discovery: System Language Discovery
                PID:3676
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • Drops desktop.ini file(s)
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:5596
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • Views/modifies file attributes
                  PID:5828
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                2⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:3812
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +h +s +r +i /D
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:5604
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -h +s +r info-Locker.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:5884
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /f /im Explorer.exe
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3648

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Privilege Escalation

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Defense Evasion

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Hide Artifacts

                  2
                  T1564

                  Hidden Files and Directories

                  2
                  T1564.001

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify Tools

                  1
                  T1562.001

                  Modify Registry

                  4
                  T1112

                  Credential Access

                  Discovery

                  System Information Discovery

                  1
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  info-Locker.txt
                  • Path C:\Users\Admin\Downloads\info-Locker.txt
                  • Size 107B
                  • SHA256 fe370adaea0d9a25b796a2461cb06e19e37690a240ff472de5cf41a775818ac8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  info-Locker.txt
                  • Path F:\info-Locker.txt
                  • Size 107B
                  • SHA256 25bf4995a2aa9a776e82b2404d49dd60381c0970e7cd45a58955fcd6238fa292
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/1316-0-0x0000000000470000-0x0000000000564000-memory.dmp
                  Download

                  memory/1316-1-0x0000000004E70000-0x0000000004F0C000-memory.dmp
                  Download

                  memory/1316-2-0x00000000054C0000-0x0000000005A64000-memory.dmp
                  Download

                  memory/1316-3-0x0000000004F10000-0x0000000004FA2000-memory.dmp
                  Download

                  memory/1316-4-0x00000000050B0000-0x00000000050C0000-memory.dmp
                  Download

                  memory/1316-5-0x0000000004E20000-0x0000000004E2A000-memory.dmp
                  Download

                  memory/1316-6-0x0000000005120000-0x0000000005176000-memory.dmp
                  Download

                  memory/1316-7-0x0000000007EA0000-0x0000000007F06000-memory.dmp
                  Download

                  memory/1316-21-0x00000000050B0000-0x00000000050C0000-memory.dmp
                  Download