Analysis
- max time kernel
298s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 18:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Archive.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
Archive.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
encryptor.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral4
Sample
encryptor.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral5
Sample
gui.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral6
Sample
gui.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
General
- Target encryptor.exe
- Size 5.9MB
- Sample260930-xd9kwazbjd
- SHA256 dfaf0e2e1c579d5a136e3b83da28d6ecfe9eec95030fe4a9918c779776f51e4e
- MD5 2da9891d978ade2f63782a080b252606
- SHA1 d55ea9133e1a13b66899a4a119996ee0cb86ce0d
- SHA512 4291a57458528d97bf4fbbca93acb41454f8af273dca169c137777205541435503bebd7db1689fd3878a6a05e4ff3ba759e4db9107e9a2baaa6c24340237da20
- SSDEEP 49152:GUmbbbCVIdGSOU0FiUX5EVG60Dd5Pnf4Imug2DVOnX6IxBjlorHFqMY50O8U6IU+:VPF/PvfkuUxBS7Ay2t+st9iOFnKJGv
- TLSH T155568E43F25254DDC21BD539C2A67637B33679892131AFBB1EC89F356E22AC48B1D318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\gmreadme.txt.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\Drivers\gmreadme.txt.locked encryptor.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I:\ encryptor.exe File opened (read-only) \??\K:\ encryptor.exe File opened (read-only) \??\P:\ encryptor.exe File opened (read-only) \??\R:\ encryptor.exe File opened (read-only) \??\U:\ encryptor.exe File opened (read-only) \??\V:\ encryptor.exe File opened (read-only) \??\Y:\ encryptor.exe File opened (read-only) \??\D:\ encryptor.exe File opened (read-only) \??\F:\ encryptor.exe File opened (read-only) \??\H:\ encryptor.exe File opened (read-only) \??\J:\ encryptor.exe File opened (read-only) \??\M:\ encryptor.exe File opened (read-only) \??\N:\ encryptor.exe File opened (read-only) \??\X:\ encryptor.exe File opened (read-only) \??\L:\ encryptor.exe File opened (read-only) \??\O:\ encryptor.exe File opened (read-only) \??\Q:\ encryptor.exe File opened (read-only) \??\T:\ encryptor.exe File opened (read-only) \??\Z:\ encryptor.exe File opened (read-only) \??\E:\ encryptor.exe File opened (read-only) \??\G:\ encryptor.exe File opened (read-only) \??\S:\ encryptor.exe File opened (read-only) \??\W:\ encryptor.exe \??\F:\ encryptor.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_fabf71923070d750\I386\unishare-pipelineconfig.xml.locked encryptor.exe File opened for modification C:\Windows\System32\en-US\lipeula.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\fr-FR\Licenses\Volume\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\HealthSystemToastIcon.png.locked encryptor.exe File opened for modification C:\Windows\System32\ja-jp\Licenses\Volume\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\oobe\uk-UA\privacy.rtf.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\_Default\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\es-ES\Licenses\OEM\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\HealthSystemToastIcon.contrast-white.png.locked encryptor.exe File opened for modification C:\Windows\System32\restore\MachineGuid.txt.locked encryptor.exe File opened for modification C:\Windows\System32\Speech_OneCore\common\toast-hero-image.png.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\icsxml\cmnicfg.xml.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\APPLETS\IMJPCLST.XML.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\uk-UA\Licenses\_Default\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\fr-FR\Licenses\OEM\IoTEnterpriseSK\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\InputSystemToastIcon.png.locked encryptor.exe File opened for modification C:\Windows\System32\it-IT\Licenses\_Default\IoTEnterpriseSK\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\default.help.txt.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\Volume\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\tokens.xml.locked encryptor.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-pipelineconfig.xml.locked encryptor.exe File opened for modification C:\Windows\System32\en-US\Licenses\Volume\IoTEnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\FeatureToastBulldogImg.png.locked encryptor.exe File opened for modification C:\Windows\System32\fr-FR\Licenses\_Default\IoTEnterpriseSK\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\@VpnToastIcon.png.locked encryptor.exe File opened for modification C:\Windows\System32\DDFs\EnterpriseModernAppManagementDDF.xml.locked encryptor.exe File opened for modification C:\Windows\System32\DisplaySystemToastIcon.contrast-white.png.locked encryptor.exe File opened for modification C:\Windows\System32\it-IT\Licenses\Volume\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\ja-jp\Licenses\_Default\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\MailContactsCalendarSync\LiveDomainList.txt.locked encryptor.exe File opened for modification C:\Windows\System32\WwanFeatureTests.xml.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\IoTEnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\es-ES\Licenses\_Default\IoTEnterpriseSK\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\uk-UA\Licenses\OEM\IoTEnterpriseSK\license.rtf.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt.locked encryptor.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_6954003ebdcd73ae\Amd64\unisharev4-pipelineconfig.xml.locked encryptor.exe File opened for modification C:\Windows\System32\HearingAidSystemToastIcon.png.locked encryptor.exe File opened for modification C:\Windows\System32\icsxml\pppcfg.xml.locked encryptor.exe File opened for modification C:\Windows\System32\it-IT\Licenses\OEM\IoTEnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\Microsoft-Edge-WebView\WidevineCdm\manifest.json.locked encryptor.exe File opened for modification C:\Windows\System32\oobe\ja-JP\privacy.rtf.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\IoTEnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\uk-UA\Licenses\_Default\IoTEnterpriseSK\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\DefaultAccountTile.png.locked encryptor.exe File opened for modification C:\Windows\System32\FeatureToastDlpImg.png.locked encryptor.exe File opened for modification C:\Windows\System32\it-IT\Licenses\OEM\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\oobe\es-ES\OOBE_HELP_Cortana_Learn_More.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\BluetoothPairingSystemToastIcon.contrast-black.png.locked encryptor.exe File opened for modification C:\Windows\System32\DDFs\DMClient_DDF.xml.locked encryptor.exe File opened for modification C:\Windows\System32\fr-FR\lpeula.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\oobe\fr-FR\privacy.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\oobe\uk-UA\vofflps.rtf.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance.png.locked encryptor.exe File opened for modification C:\Windows\System32\ComputerToastIcon.png.locked encryptor.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_d2cabcec66b8ad75\Amd64\MSECP-pipelineconfig.xml.locked encryptor.exe File opened for modification C:\Windows\System32\oobe\ja-JP\OOBE_HELP_Opt_in_Details.rtf.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\IoTEnterpriseSK\license.rtf.locked encryptor.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\Volume\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.locked encryptor.exe File opened for modification C:\Windows\System32\en-US\Licenses\Volume\EnterpriseS\license.rtf.locked encryptor.exe File opened for modification C:\Windows\System32\OEMDefaultAssociations.xml.locked encryptor.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt.locked encryptor.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.locked encryptor.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecurityAppList.scale-400.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_ie8.gif.locked encryptor.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.locked encryptor.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\VisualElements\SmallLogo.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\vk_swiftshader_icd.json.locked encryptor.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\avtransport.xml.locked encryptor.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMeetingReqReadNaiveBayesCommandRanker.txt.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfig.xml.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check_2x.png.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\VisualElements\LogoBeta.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.GIF.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\PREVIEW.GIF.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_retina.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png.locked encryptor.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png.locked encryptor.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecurityMedTile.scale-125.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons2x.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_pattern_RHP.png.locked encryptor.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt.locked encryptor.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt.locked encryptor.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt.locked encryptor.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-200.png.locked encryptor.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecuritySplashScreen.scale-200.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-up.png.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] encryptor.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb_new.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\excluded.txt.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.MX.XML.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] encryptor.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecuritySplashScreen.scale-125_contrast-white.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud_retina.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif.locked encryptor.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.locked encryptor.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.CO.TH.XML.locked encryptor.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\GameBarWidgetUI\Icons\icon.light.targetsize-32.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\LogoCanary.png.locked encryptor.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WindowsSecurityMedTile.scale-150_contrast-black.png.locked encryptor.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityAppList.targetsize-256_altform-lightunplated_contrast-white.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\download-btn.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark-2x.png.locked encryptor.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\VisualElements\SmallLogoCanary.png.locked encryptor.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoDev.png.locked encryptor.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\tokens_deDE.xml.locked encryptor.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-24_altform-unplated_contrast-black.png.locked encryptor.exe File opened for modification C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\Assets\SplashScreen.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\StartMenu\Assets\FileIcons\24\folder.scale-200.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-photon_31bf3856ad364e35_10.0.26100.1591_none_faf85d9f2170dfcf\r\Photon\Public\wsxpacks\Account\assets\strings\it-IT.json.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\975b69eb30393cebd6885b635d2336e84c986366.xml.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-photon_31bf3856ad364e35_10.0.26100.1591_none_faf85d9f2170dfcf\r\Photon\Public\wsxpacks\AccountControl\assets\strings\he-IL.json.locked encryptor.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallCommon.sql.locked encryptor.exe File opened for modification C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\Cortana.UI\Assets\Icons\AppListIcon.targetsize-96.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.26100.1591_none_63fb7034074e9c4e\AnswerWithVideo.scale-400.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\StartMenu\Assets\FileIcons\32\email.scale-100.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15912.0_it-it_0f68f9b34d7955a9\SqlPersistenceProviderSchema.sql.locked encryptor.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-l..terprises.resources_31bf3856ad364e35_10.0.26100.1_de-de_fac1f54aee86bd90\license.rtf.locked encryptor.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClipping\Assets\Wide310x150Logo.scale-200.png.locked encryptor.exe File opened for modification C:\Windows\Web\Screen\img102.jpg.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ep-chxapp.appxsetup_31bf3856ad364e35_10.0.26100.1_none_05aae033ab703f80\appxmanifest.xml.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-installcommon_sql_b03f5f7f11d50a3a_4.0.15912.0_none_f1f1b0e80192c23d\InstallCommon.sql.locked encryptor.exe File opened for modification C:\Windows\PLA\Rules\Rules.System.CPU.xml.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-edp-task_31bf3856ad364e35_10.0.26100.1591_none_8ec1f335c66c34f3\@bitlockertoastimage.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1455_none_6d781ec5015f8eb0\oskmenubase.xml.locked encryptor.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.locked encryptor.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\es\Tracking_Logic.sql.locked encryptor.exe File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.Configuration.xml.locked encryptor.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorAppList.targetsize-64_altform-unplated_contrast-black.png.locked encryptor.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\StartMenu\Assets\FileIcons\32\audio.scale-200.png.locked encryptor.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\guidedsetup\network\area-content\id-ID\area-content.local.json.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\Cortana.UI\Assets\Icons\contrast-white\MediumTile.scale-400.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-photon_31bf3856ad364e35_10.0.26100.1591_none_faf85d9f2170dfcf\Photon\Public\wsxpacks\AccountControl\assets\strings\nb-NO.json.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_10.0.26100.1_de-de_09be5cdc14446fa0\Rules.System.Common.xml.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.26100.1_none_d8b49063cb34877d\RibbonToast.scale-200_theme-light.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\Assets\contrast-white\GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png.locked encryptor.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RedistList\FrameworkList.xml.locked encryptor.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Common.xml.locked encryptor.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-48_altform-lightunplated.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.26100.1591_none_b67e058f470e99bc\Personalize.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.26100.1591_none_97b3f064acd38654\Square71x71Logo.contrast-white_scale-200.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\NarratorAppList.targetsize-20_contrast-white.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_10.0.26100.1_de-de_09be5cdc14446fa0\Rules.System.Performance.xml.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.26100.1150_none_cf3b1bf5ee04490b\ceb497ee0184aaa4681d2fb2ef242a5b8551eea8.xml.locked encryptor.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Images\headermaximize.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_dual_prnms007.inf_31bf3856ad364e35_10.0.26100.1_none_b7d163018e895c80\Amd64\MSPWGR-pipelineconfig.xml.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.26100.1_none_bccfcfe991e4efd9\i_just_my_code.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.26100.1_none_bccfcfe991e4efd9\toggleSourceMap.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\Cortana.UI\Assets\splashscreen.contrast-black_scale-140.png.locked encryptor.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\Lock.png.locked encryptor.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\SQL\es\SqlPersistenceProviderSchema.sql.locked encryptor.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorAppList.targetsize-80_contrast-black.png.locked encryptor.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\StartMenu\Assets\FileIcons\24\pdf.scale-100.png.locked encryptor.exe File opened for modification C:\Windows\WaaS\regkeys\a1026e97d46e89c55e97134de3823210f59708cb.xml.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-f..cing-desktop-compdb_31bf3856ad364e35_10.0.26100.1_none_b5e976de7d403c20\DesktopTargetCompDB_FOD_zh-tw.xml.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.26100.1150_none_e988d1d7ba71eb54\Icon_MMXresume.scale-200.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\data\prod\uriRules.json.locked encryptor.exe File opened for modification C:\Windows\Media\Windows Print complete.wav.locked encryptor.exe File opened for modification C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\Cortana.UI\Assets\Icons\contrast-white\AppListIcon.targetsize-96.png.locked encryptor.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\speech\0c09\tokens_enAU.xml.locked encryptor.exe File opened for modification C:\Windows\UUS\amd64\RestartNowPower_80.contrast-white.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.scale-140.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..st.appxmain.desktop_31bf3856ad364e35_10.0.26100.1591_none_24d501a973fa7371\zdpLottie.json.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\webapps\guidedsetup\network\area-content\nb-NO\area-content.local.json.locked encryptor.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\connectionmanager_dmr.xml.locked encryptor.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Summary.xml.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars34.contrast-black_scale-200.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\NarratorAppList.scale-200_contrast-black.png.locked encryptor.exe File opened for modification C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.26100.1_none_0b51b9a2b822763d\headerGRADIENT_Tall.gif.locked encryptor.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4448 gui.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4480 wrote to memory of 4448 4480 encryptor.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\encryptor.exe"C:\Users\Admin\AppData\Local\Temp\encryptor.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\gui.exe"C:\Users\Admin\AppData\Local\Temp\gui.exe" --uuid d2ba0952-b544-4800-be68-84c7ffd2f93e2⤵
- Suspicious use of FindShellTrayWindow
PID:4448
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1