ed4d2598b6969424439b9420b64d2847f5640e642b3dad4e50a71b573077b34c

Analysis

user interaction
yes
max time kernel
17s
max time network
10s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UxLocker_Build.exe
Size 183KB
Sample260922-pefp7averb
SHA256 ed4d2598b6969424439b9420b64d2847f5640e642b3dad4e50a71b573077b34c
MD5 14d8fbe6ceef4c64e03799b1ac26f765
SHA1 91825e24e4f70261988d8214dc36687d3c57e1b6
SHA512 be2452e80fc8fb2b06a06ab1d67d3a2792307c421a040ccbc73ae7da5747c207fd199c4acb56b20ddbca16419e52137acba53fc7a41b655d5cbafb710c470ff4
SSDEEP 3072:+h4pzFUOcaiYihrnZqh2fkoU3BKuP/eRqbk6BHD7rb:+qpJUOcD8h2fkoUR0RqbP
TLSH
T1AC044B053BB9AD36CDAC123AB0A6660543FAE512D263EB847C8D98FD5ED3701D706B43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	UxLocker_Build.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	UxLocker_Build.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	UxLocker_Build.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	UxLocker_Build.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UxLocker_Build.exe\" -startup"	UxLocker_Build.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	UxLocker_Build.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	UxLocker_Build.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	UxLocker_Build.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	UxLocker_Build.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UxLocker_Build.exe\""	UxLocker_Build.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3300	cmd.exe
3364	cmd.exe
2872	cmd.exe
3572	cmd.exe
6020	cmd.exe
3444	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4648	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5164	UxLocker_Build.exe
5164	UxLocker_Build.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5164	UxLocker_Build.exe
Token: SeDebugPrivilege	4648	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 3444	5164	UxLocker_Build.exe	91
PID 5164 wrote to memory of 6020	5164	UxLocker_Build.exe	92
PID 5164 wrote to memory of 3572	5164	UxLocker_Build.exe	93
PID 5164 wrote to memory of 2872	5164	UxLocker_Build.exe	94
PID 5164 wrote to memory of 3364	5164	UxLocker_Build.exe	95
PID 5164 wrote to memory of 3300	5164	UxLocker_Build.exe	96
PID 5164 wrote to memory of 4648	5164	UxLocker_Build.exe	97
PID 3444 wrote to memory of 5920	3444	cmd.exe	115
PID 6020 wrote to memory of 3920	6020	cmd.exe	116
PID 3364 wrote to memory of 5140	3364	cmd.exe	117
PID 2872 wrote to memory of 4488	2872	cmd.exe	118
PID 3572 wrote to memory of 5836	3572	cmd.exe	120
PID 3300 wrote to memory of 4864	3300	cmd.exe	121
PID 3444 wrote to memory of 3228	3444	cmd.exe	122
PID 3364 wrote to memory of 1200	3364	cmd.exe	124
PID 6020 wrote to memory of 552	6020	cmd.exe	125
PID 2872 wrote to memory of 1848	2872	cmd.exe	126
PID 3300 wrote to memory of 4984	3300	cmd.exe	127
PID 3572 wrote to memory of 2420	3572	cmd.exe	128

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5920	attrib.exe
3920	attrib.exe
5140	attrib.exe
5836	attrib.exe
3228	attrib.exe
4864	attrib.exe
1848	attrib.exe
2420	attrib.exe
4488	attrib.exe
4984	attrib.exe
552	attrib.exe
1200	attrib.exe

C:\Users\Admin\AppData\Local\Temp\UxLocker_Build.exe
"C:\Users\Admin\AppData\Local\Temp\UxLocker_Build.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @gdeclover 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5920
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-0v92.txt
    3⤵
    - Views/modifies file attributes
    PID:3228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @gdeclover 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3920
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-0v92.txt
    3⤵
    - Views/modifies file attributes
    PID:552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @gdeclover 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5836
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-0v92.txt
    3⤵
    - Views/modifies file attributes
    PID:2420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @gdeclover 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4488
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-0v92.txt
    3⤵
    - Views/modifies file attributes
    PID:1848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @gdeclover 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5140
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-0v92.txt
    3⤵
    - Views/modifies file attributes
    PID:1200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @gdeclover 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4864
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-0v92.txt
    3⤵
    - Views/modifies file attributes
    PID:4984
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4648

C:\Users\Admin\AppData\Local\Temp\UxLocker_Build.exe
"C:\Users\Admin\AppData\Local\Temp\UxLocker_Build.exe"
1⤵
PID:4328

C:\Users\Admin\AppData\Local\Temp\UxLocker_Build.exe
"C:\Users\Admin\AppData\Local\Temp\UxLocker_Build.exe" -startup
1⤵
PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-0v92.txt

Path F:\info-0v92.txt
Size 105B
SHA256 383ed540520c379862cde6c08481dd59b7be677f70f5d5ef7cb51c7d7ad2b5b8
MD5 95f58501440829870dd8431db5dd1126
SHA1 ac52137ba221250b51a032b1a11c70055d1bf9b9
SHA512 b44d0587dfbcc1fc4ffe86604dce7ca5324337b8ca01269cf371b7b65701ebde4817ffaf98995165326fb6982237dd3d2e7751a77ea24277acbe1cc6a1656239
TLSH
T183B022202FBC03C0A20000F0F33030B03AAEE0CFC02F0883000000A200020A00CEB2A8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5164-4-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-14-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-3-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-0-0x00007FF81878F000-0x00007FF818790000-memory.dmp

Download

memory/5164-5-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-6-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-7-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-8-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-2-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-11-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-10-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-1-0x0000029BD4F80000-0x0000029BD4FB4000-memory.dmp

Download

memory/5164-27-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-28-0x0000029BF08C0000-0x0000029BF09B0000-memory.dmp

Download

memory/5164-29-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-30-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-31-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/5164-32-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download