8b441ab4f1a25fae9a46db53b17d64cab7293ca710b202ba1a96c5c826737bde

Analysis

user interaction
yes
max time kernel
43s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9jRyGEZ8mt1v2PK.exe
Size 2.4MB
Sample261001-pb8lssbd79
SHA256 8b441ab4f1a25fae9a46db53b17d64cab7293ca710b202ba1a96c5c826737bde
MD5 2d16a6173ca98c84a49f6b90f2697c5e
SHA1 b71991a176cb3b5492ebabcab76e4ae780a50c7b
SHA512 7d152f836964b9d291dfc52dd878eea78ee2da2413a779df02689e76d7dad84c3abc74563ad57f381195e1f59e410f211aceab7017def533ef4980aa6aa926f4
SSDEEP 49152:jQZX1YsxW42Qk4TjkAR7njkilrYeb2eb2zzh0Tpgjjd9SrBz957T:HtxQdfBk6seb2eb2zV8gjHSrBz9
TLSH
T16EC5238B7285439ED0B875769A66821103D1D3E732FBE685FE5B02D31E033FA5E942C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4024	9jRyGEZ8mt1v2PK.exe
1232	9jRyGEZ8mt1v2PK.exe
4036	9jRyGEZ8mt1v2PK.exe
2952	9jRyGEZ8mt1v2PK.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	9jRyGEZ8mt1v2PK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	9jRyGEZ8mt1v2PK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	9jRyGEZ8mt1v2PK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	9jRyGEZ8mt1v2PK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	9jRyGEZ8mt1v2PK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	9jRyGEZ8mt1v2PK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\666999666 = "C:\\Users\\Public\\Documents\\9jRyGEZ8mt1v2PK.exe"	9jRyGEZ8mt1v2PK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9jRyGEZ8mt1v2PK.exe\" -startup"	9jRyGEZ8mt1v2PK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9jRyGEZ8mt1v2PK.exe\""	9jRyGEZ8mt1v2PK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	9jRyGEZ8mt1v2PK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	9jRyGEZ8mt1v2PK.exe

Drops desktop.ini file(s) 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	attrib.exe
\??\F:\	attrib.exe
\??\F:\	cmd.exe
\??\F:\	attrib.exe
\??\F:\	attrib.exe
\??\F:\	cmd.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1880	cmd.exe
2584	cmd.exe
5720	cmd.exe
4392	cmd.exe
2688	cmd.exe
4192	cmd.exe
4132	cmd.exe
436	cmd.exe
4780	cmd.exe
4644	cmd.exe
2772	cmd.exe
2056	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 988 set thread context of 4024	988	9jRyGEZ8mt1v2PK.exe	88

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5172	1232	WerFault.exe	90
2856	4036	WerFault.exe	128
4540	2952	WerFault.exe	129

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9jRyGEZ8mt1v2PK.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	9jRyGEZ8mt1v2PK.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9jRyGEZ8mt1v2PK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9jRyGEZ8mt1v2PK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9jRyGEZ8mt1v2PK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9jRyGEZ8mt1v2PK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9jRyGEZ8mt1v2PK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5016	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4024	9jRyGEZ8mt1v2PK.exe
4024	9jRyGEZ8mt1v2PK.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	9jRyGEZ8mt1v2PK.exe
Token: SeDebugPrivilege	1232	9jRyGEZ8mt1v2PK.exe
Token: SeDebugPrivilege	4024	9jRyGEZ8mt1v2PK.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	4036	9jRyGEZ8mt1v2PK.exe
Token: SeDebugPrivilege	2952	9jRyGEZ8mt1v2PK.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 4024	988	9jRyGEZ8mt1v2PK.exe	88
PID 988 wrote to memory of 4024	988	9jRyGEZ8mt1v2PK.exe	88
PID 988 wrote to memory of 4024	988	9jRyGEZ8mt1v2PK.exe	88
PID 988 wrote to memory of 4024	988	9jRyGEZ8mt1v2PK.exe	88
PID 988 wrote to memory of 4024	988	9jRyGEZ8mt1v2PK.exe	88
PID 4024 wrote to memory of 5720	4024	9jRyGEZ8mt1v2PK.exe	92
PID 4024 wrote to memory of 2772	4024	9jRyGEZ8mt1v2PK.exe	93
PID 4024 wrote to memory of 2584	4024	9jRyGEZ8mt1v2PK.exe	94
PID 4024 wrote to memory of 4644	4024	9jRyGEZ8mt1v2PK.exe	95
PID 4024 wrote to memory of 1880	4024	9jRyGEZ8mt1v2PK.exe	96
PID 4024 wrote to memory of 4780	4024	9jRyGEZ8mt1v2PK.exe	97
PID 4024 wrote to memory of 5016	4024	9jRyGEZ8mt1v2PK.exe	104
PID 5720 wrote to memory of 4084	5720	cmd.exe	116
PID 4780 wrote to memory of 2760	4780	cmd.exe	117
PID 2584 wrote to memory of 4588	2584	cmd.exe	118
PID 4644 wrote to memory of 1920	4644	cmd.exe	119
PID 1880 wrote to memory of 5360	1880	cmd.exe	120
PID 2772 wrote to memory of 4612	2772	cmd.exe	121
PID 4780 wrote to memory of 3856	4780	cmd.exe	122
PID 1880 wrote to memory of 4136	1880	cmd.exe	123
PID 4644 wrote to memory of 4404	4644	cmd.exe	124
PID 2584 wrote to memory of 568	2584	cmd.exe	125
PID 5720 wrote to memory of 4836	5720	cmd.exe	126
PID 2772 wrote to memory of 1300	2772	cmd.exe	127
PID 4024 wrote to memory of 4392	4024	9jRyGEZ8mt1v2PK.exe	138
PID 4024 wrote to memory of 436	4024	9jRyGEZ8mt1v2PK.exe	139
PID 4024 wrote to memory of 2056	4024	9jRyGEZ8mt1v2PK.exe	140
PID 4024 wrote to memory of 4132	4024	9jRyGEZ8mt1v2PK.exe	141
PID 4024 wrote to memory of 4192	4024	9jRyGEZ8mt1v2PK.exe	142
PID 4024 wrote to memory of 2688	4024	9jRyGEZ8mt1v2PK.exe	143
PID 2056 wrote to memory of 6012	2056	cmd.exe	150
PID 436 wrote to memory of 1772	436	cmd.exe	151
PID 4132 wrote to memory of 3040	4132	cmd.exe	152
PID 2688 wrote to memory of 4080	2688	cmd.exe	153
PID 4192 wrote to memory of 5544	4192	cmd.exe	154
PID 2056 wrote to memory of 3372	2056	cmd.exe	155
PID 4392 wrote to memory of 1332	4392	cmd.exe	156
PID 436 wrote to memory of 3524	436	cmd.exe	157
PID 4132 wrote to memory of 5780	4132	cmd.exe	158
PID 4192 wrote to memory of 5284	4192	cmd.exe	159
PID 4392 wrote to memory of 4380	4392	cmd.exe	160
PID 2688 wrote to memory of 1476	2688	cmd.exe	161

Views/modifies file attributes 1 TTPs 24 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4404	attrib.exe
3040	attrib.exe
1920	attrib.exe
5360	attrib.exe
4612	attrib.exe
3856	attrib.exe
4836	attrib.exe
4136	attrib.exe
5544	attrib.exe
1772	attrib.exe
1332	attrib.exe
5780	attrib.exe
5284	attrib.exe
4380	attrib.exe
6012	attrib.exe
2760	attrib.exe
4588	attrib.exe
1300	attrib.exe
1476	attrib.exe
4084	attrib.exe
4080	attrib.exe
3372	attrib.exe
3524	attrib.exe
568	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9jRyGEZ8mt1v2PK.exe
"C:\Users\Admin\AppData\Local\Temp\9jRyGEZ8mt1v2PK.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988
- C:\Users\Admin\AppData\Local\Temp\9jRyGEZ8mt1v2PK.exe
  "C:\Users\Admin\AppData\Local\Temp\9jRyGEZ8mt1v2PK.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Enumerates connected drives
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4836
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1300
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:568
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5360
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /im Explorer.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c F: & attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
    3⤵
    - Enumerates connected drives
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -i /D
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s -r desktop.ini
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%\desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -i /D
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s -r desktop.ini
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3524
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -i /D
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:6012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s -r desktop.ini
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3372
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%\downloads"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -i /D
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s -r desktop.ini
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5780
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%\documents"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -i /D
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s -r desktop.ini
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5284
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -i /D
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s -r desktop.ini
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1476

C:\Users\Public\Documents\9jRyGEZ8mt1v2PK.exe
C:\Users\Public\Documents\9jRyGEZ8mt1v2PK.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 900
  2⤵
  - Program crash
  PID:5172

C:\Users\Admin\AppData\Local\Temp\9jRyGEZ8mt1v2PK.exe
"C:\Users\Admin\AppData\Local\Temp\9jRyGEZ8mt1v2PK.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 884
  2⤵
  - Program crash
  PID:2856

C:\Users\Admin\AppData\Local\Temp\9jRyGEZ8mt1v2PK.exe
"C:\Users\Admin\AppData\Local\Temp\9jRyGEZ8mt1v2PK.exe" -startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 872
  2⤵
  - Program crash
  PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1232 -ip 1232
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4036 -ip 4036
1⤵
PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2952 -ip 2952
1⤵
PID:264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9jRyGEZ8mt1v2PK.exe

Path C:\Users\Admin\AppData\Local\Temp\9jRyGEZ8mt1v2PK.exe
Size 2.4MB
SHA256 8b441ab4f1a25fae9a46db53b17d64cab7293ca710b202ba1a96c5c826737bde
MD5 2d16a6173ca98c84a49f6b90f2697c5e
SHA1 b71991a176cb3b5492ebabcab76e4ae780a50c7b
SHA512 7d152f836964b9d291dfc52dd878eea78ee2da2413a779df02689e76d7dad84c3abc74563ad57f381195e1f59e410f211aceab7017def533ef4980aa6aa926f4
SSDEEP 49152:jQZX1YsxW42Qk4TjkAR7njkilrYeb2eb2zzh0Tpgjjd9SrBz957T:HtxQdfBk6seb2eb2zV8gjHSrBz9
TLSH
T16EC5238B7285439ED0B875769A66821103D1D3E732FBE685FE5B02D31E033FA5E942C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Desktop\info-Locker.txt
Size 83B
SHA256 f9a108420af8aed0987e953eaad10eccfa0bfe55fb3f8e38fe7590b7e33fd8b3
MD5 4ef98b2699598f8fcf5b371249e6b1f8
SHA1 d4efe3af075540ebf9bb1687ea1fa677157147fe
SHA512 e68ceff7a52b2b882ac5e9f4d981cb536b587c514b740eccdb1b06e128b2eb0d982337db8b356535558a9a97448b9e6ad214f3ebc846d41f04d5db27c408a25e
TLSH
T1E3A012C12C5C2268101611F236326001257CD81C10332542454001560050080A4BF518
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path F:\info-Locker.txt
Size 83B
SHA256 915f81b7c66ae55830b751b9dd5799ff56f23f1570cb09965756c059ed6f7d6d
MD5 af9e151f04e550121070890445686ba2
SHA1 56702a20f56105edf3d4bb493f86774ad9372f35
SHA512 aba6c38aa924f25e3e928633bab9cbc1ec345db28ec26bf08bc6ad78b814207d7f0add8d9b5e73b937cbc2f437f735e99e3006e5310b63c6c1b734802cdb58fa
TLSH
T1CAA012412C582258102321F235316001247CF81C103328424640019600500C194AF618
MD5 SHA1 SHA512 TLSH

Submit Download

memory/988-10-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-5-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-24-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-33-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-47-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-45-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-43-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-41-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-39-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-38-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-35-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-31-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-29-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-27-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-25-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-19-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-17-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-13-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-11-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-0-0x00000000744C2000-0x00000000744C3000-memory.dmp

Download

memory/988-15-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-7-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-21-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-4-0x0000000005D40000-0x0000000005F8E000-memory.dmp

Download

memory/988-3-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/988-1-0x0000000000D20000-0x0000000000F8A000-memory.dmp

Download

memory/988-2-0x0000000005D40000-0x0000000005F94000-memory.dmp

Download

memory/988-52-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/1232-58-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/1232-214-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/1232-212-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/1232-104-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/4024-57-0x00000000053B0000-0x00000000053BA000-memory.dmp

Download

memory/4024-59-0x00000000055C0000-0x0000000005616000-memory.dmp

Download

memory/4024-51-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/4024-49-0x0000000000B60000-0x0000000000D9A000-memory.dmp

Download

memory/4024-105-0x0000000008E50000-0x0000000008EB6000-memory.dmp

Download

memory/4024-56-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/4024-50-0x0000000005480000-0x000000000551C000-memory.dmp

Download

memory/4024-211-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/4024-54-0x0000000005520000-0x00000000055B2000-memory.dmp

Download

memory/4024-213-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/4024-53-0x0000000005AE0000-0x000000000609A000-memory.dmp

Download

memory/4024-215-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download