Overview

overview

10

Static

static

3

UXCryptor.exe

windows10-2004-x64

10

UXCryptor.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 16:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UXCryptor.exe
  • Size 955KB
  • Sample260809-tnnvdat1ay
  • SHA256 006bf2afe80ac82b2a164c60f7612652c29f65fd4c1ab08e273b4d1f19617b58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • UAC bypass 3 TTPs 18 IoCs
    defense_evasiontrojan
  • Disables RegEdit via registry modification 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 24 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 36 IoCs
    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    defense_evasion
  • Views/modifies file attributes 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5216
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:1904
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6320
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:5928
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        PID:2240
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6284
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:4316
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6328
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:6028
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:6924
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4168
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6800
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4608
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6632
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im Explorer.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3452
  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2980
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      PID:2796
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6696
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:6148
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:4920
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:6368
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4336
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:1028
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6416
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5504
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        PID:6348
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6644
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      PID:5636
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:6672
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:7088
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:4196
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6264
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:6984
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im Explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:208
  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --wininit
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4268
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Views/modifies file attributes
        PID:6236
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:7108
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        PID:5580
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:6276
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6184
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6712
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5176
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:6228
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:7060
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:3648
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3092
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6388
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6208
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • Views/modifies file attributes
        PID:6976
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im Explorer.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4108
  • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" -startup
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4300
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      PID:5568
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Views/modifies file attributes
        PID:6540
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:7120
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +s +r +i /D
        3⤵
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:6356
      • C:\Windows\SysWOW64\attrib.exe
        attrib -h +s +r info-Locker.txt
        3⤵
          PID:7052
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:5588
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:6624
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:7128
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:5148
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:6680
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
          • Views/modifies file attributes
          PID:7144
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:4800
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s +r +i /D
          3⤵
          • Drops desktop.ini file(s)
          • Views/modifies file attributes
          PID:6576
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h +s +r info-Locker.txt
          3⤵
            PID:6840
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:5380
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:6568
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:7068
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /f /im Explorer.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3248
      • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
        "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /setup
        1⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Disables RegEdit via registry modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4724
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:4632
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Views/modifies file attributes
            PID:6784
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:1028
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:5228
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:6808
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:6204
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:828
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:6300
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:6968
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:4208
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            PID:6792
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:7152
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:928
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            PID:6408
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:6720
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:2684
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Views/modifies file attributes
            PID:6740
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:7136
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /f /im Explorer.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5020
      • C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
        "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --init
        1⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Disables RegEdit via registry modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:688
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:5648
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Views/modifies file attributes
            PID:6460
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:6776
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:4692
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:6872
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:4920
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:3560
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:6436
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:6768
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:2144
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:6856
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:7000
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          PID:4308
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Drops desktop.ini file(s)
            • Views/modifies file attributes
            PID:6596
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • Views/modifies file attributes
            PID:6828
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @antil0ck_bot OR discord theallahhimself 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
          2⤵
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:2192
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s +r +i /D
            3⤵
            • Views/modifies file attributes
            PID:6948
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h +s +r info-Locker.txt
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2000
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /f /im Explorer.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4824
      • C:\Windows\System32\sihclient.exe
        C:\Windows\System32\sihclient.exe /cv Y9UNstfqe0KTtZWn/jvTeQ.0.2
        1⤵
          PID:3092

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Hide Artifacts

              2
              T1564

              Hidden Files and Directories

              2
              T1564.001

              Impair Defenses

              1
              T1562

              Disable or Modify Tools

              1
              T1562.001

              Modify Registry

              4
              T1112

              Credential Access

              Discovery

              System Information Discovery

              1
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              info-Locker.txt
              • Path C:\Users\Admin\Desktop\info-Locker.txt
              • Size 107B
              • SHA256 86295e4cdb7756ad3594756406538db9c7adc934c1078554aa6cd72736793c81
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              info-Locker.txt
              • Path C:\Users\Admin\Desktop\info-Locker.txt
              • Size 107B
              • SHA256 39c32ff08b98582ed8ec4e12c5cc3fbce5a169c328321f8fd39ddf83cb689706
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              info-Locker.txt
              • Path C:\Users\Admin\Documents\info-Locker.txt
              • Size 107B
              • SHA256 1a469a9f34e25d971296c0bae7e7bd3fd9e19bab8bca2663defca94bff516ef6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              info-Locker.txt
              • Path C:\Users\Admin\info-Locker.txt
              • Size 107B
              • SHA256 fa594eec738ea6eb1518758d367a3b7e634a092c607eca8356142ebc10ccea93
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/2980-9-0x0000000074CD0000-0x000000007548C000-memory.dmp
              Download

              memory/2980-34-0x0000000074CD0000-0x000000007548C000-memory.dmp
              Download

              memory/2980-16-0x0000000074CD0000-0x000000007548C000-memory.dmp
              Download

              memory/2980-12-0x0000000074CD0000-0x000000007548C000-memory.dmp
              Download

              memory/4268-10-0x0000000074CD0000-0x000000007548C000-memory.dmp
              Download

              memory/4268-17-0x0000000074CD0000-0x000000007548C000-memory.dmp
              Download

              memory/4268-25-0x0000000074CD0000-0x000000007548C000-memory.dmp
              Download

              memory/4268-11-0x0000000074CD0000-0x000000007548C000-memory.dmp
              Download

              memory/5216-6-0x0000000074CD0000-0x000000007548C000-memory.dmp
              Download

              memory/5216-14-0x0000000074CE2000-0x0000000074CE3000-memory.dmp
              Download

              memory/5216-15-0x0000000074CD0000-0x000000007548C000-memory.dmp
              Download

              memory/5216-8-0x0000000008730000-0x0000000008796000-memory.dmp
              Download

              memory/5216-7-0x0000000005020000-0x0000000005076000-memory.dmp
              Download

              memory/5216-5-0x0000000004E20000-0x0000000004E2A000-memory.dmp
              Download

              memory/5216-4-0x0000000004EE0000-0x0000000004F72000-memory.dmp
              Download

              memory/5216-0-0x0000000074CE2000-0x0000000074CE3000-memory.dmp
              Download

              memory/5216-3-0x00000000054A0000-0x0000000005A5A000-memory.dmp
              Download

              memory/5216-2-0x0000000004E40000-0x0000000004EDC000-memory.dmp
              Download

              memory/5216-1-0x0000000000210000-0x0000000000304000-memory.dmp
              Download