Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - max time kernel
60s - max time network
2s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
encryptor.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
60 seconds
General
- Target encryptor.exe
- Size 227KB
- Sample260924-scaypsff76
- SHA256 f9a8a7f91c1d93d922cf513ffbb9ac2c9ab3bde2cfb616cbb28b1e987b2dd23e
- MD5 d6de7a403f5f914377fd145e8f4d724b
- SHA1 40922fc3f7c7f24358205b650928dda0531e3790
- SHA512 3bcb038b3d90e65af5bc7f2b717a84c9f68c927d2925ba44889423dab7f0bfd72671fd7d54e5e9ca0b031a2d21379c13f315fb8b780f17d50ffe616c40f34470
- SSDEEP 6144:aMdhJUfoi6K9u6YVEa/vmLhqnwrrDfL3:IEXl24nyXb
- TLSH T19C348E19B7A50CFAE5678178C9514905DB737C8247A0EBDF03E04A978F23AE09E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm OfficeClickToRun.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe - Modifies data under HKEY_USERS 26 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeClickToRun.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\LockFile encryptor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\LockFile\ = "Encrypted File" encryptor.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\.lock encryptor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\.lock\ = "LockFile" encryptor.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\.lock\OpenWithProgids encryptor.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\.lock\OpenWithProgids\LockFile = "0" encryptor.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1032 encryptor.exe 1032 encryptor.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1372 Process not Found 3176 Process not Found 3728 Process not Found 4560 Process not Found 1940 Process not Found 3596 Process not Found 3692 Process not Found 4140 Process not Found 2200 Process not Found 2464 Process not Found 1252 Process not Found 2736 Process not Found 4656 Process not Found 4380 Process not Found 4184 Process not Found 4164 Process not Found 4856 Process not Found 1724 Process not Found 1756 Process not Found 3808 Process not Found 3792 Process not Found 732 Process not Found 5044 Process not Found 2732 Process not Found 4400 Process not Found 3228 Process not Found 4792 Process not Found 3672 Process not Found 3088 Process not Found 844 Process not Found 4540 Process not Found 2152 Process not Found 3572 Process not Found 3304 Process not Found 3300 Process not Found 3328 Process not Found 3128 Process not Found 2676 Process not Found 4980 Process not Found 3500 Process not Found 212 Process not Found 204 Process not Found 224 Process not Found 1044 Process not Found 4244 Process not Found 364 Process not Found 4512 Process not Found 2908 Process not Found 4072 Process not Found 1548 Process not Found 4772 Process not Found 2784 Process not Found 5112 Process not Found 4388 Process not Found 3804 Process not Found 3124 Process not Found 3512 Process not Found 4916 Process not Found 4712 Process not Found 2856 Process not Found 5008 Process not Found 3928 Process not Found 960 Process not Found 4016 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4484 OfficeClickToRun.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\encryptor.exe"C:\Users\Admin\AppData\Local\Temp\encryptor.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1032
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:4340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:2600