80229b275ca9f02dd57a3f6e10fb4a3b6453193180b48eb93f7b8790412b2cbf

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shadowsnoser.exe
Size 211KB
Sample261024-regzcsat6x
SHA256 80229b275ca9f02dd57a3f6e10fb4a3b6453193180b48eb93f7b8790412b2cbf
MD5 f22397e3d13fa9c9f599298b077232cf
SHA1 d9ceb295d2ad235faa3a5f59f8a4bec82f4cc414
SHA512 5ce3daf4754934b1d2d7d41375465e08bb66ce74cf5aa010e0ad465d4941f3d5415be5ac861b3f23f751fa71e827341a691376e48f775fac7f2907a0b1a7670c
SSDEEP 6144:8l8A/ehUOqxaPB/VmQrKUiPbDddASCpMW90KImQiXnhbmew:8eAwUOqxaPFVZYvj
TLSH
T1A4244A9813AB897DD63D237ED0A1110507F4A227C103E35E9EE5E4F95F2B312AB12B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	shadowsnoser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	shadowsnoser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	shadowsnoser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	shadowsnoser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	shadowsnoser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	shadowsnoser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\shadowsnoser.exe\" -startup"	shadowsnoser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\shadowsnoser.exe\""	shadowsnoser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	shadowsnoser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	shadowsnoser.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5928	cmd.exe
2692	cmd.exe
2980	cmd.exe
5372	cmd.exe
4896	cmd.exe
3236	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	shadowsnoser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	shadowsnoser.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4960	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2340	shadowsnoser.exe
2340	shadowsnoser.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	shadowsnoser.exe
Token: SeDebugPrivilege	4960	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3236	2340	shadowsnoser.exe	97
PID 2340 wrote to memory of 4896	2340	shadowsnoser.exe	98
PID 2340 wrote to memory of 5372	2340	shadowsnoser.exe	99
PID 2340 wrote to memory of 2980	2340	shadowsnoser.exe	100
PID 2340 wrote to memory of 2692	2340	shadowsnoser.exe	101
PID 2340 wrote to memory of 5928	2340	shadowsnoser.exe	102
PID 2340 wrote to memory of 4960	2340	shadowsnoser.exe	103
PID 2692 wrote to memory of 4176	2692	cmd.exe	114
PID 2692 wrote to memory of 4444	2692	cmd.exe	115
PID 3236 wrote to memory of 2924	3236	cmd.exe	116
PID 5928 wrote to memory of 4848	5928	cmd.exe	117
PID 2980 wrote to memory of 3436	2980	cmd.exe	118
PID 5372 wrote to memory of 3360	5372	cmd.exe	119
PID 4896 wrote to memory of 2648	4896	cmd.exe	120
PID 5928 wrote to memory of 5292	5928	cmd.exe	122
PID 5372 wrote to memory of 2708	5372	cmd.exe	123
PID 3236 wrote to memory of 3472	3236	cmd.exe	124
PID 2980 wrote to memory of 3396	2980	cmd.exe	125
PID 4896 wrote to memory of 1624	4896	cmd.exe	127

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4848	attrib.exe
4444	attrib.exe
5292	attrib.exe
4176	attrib.exe
3360	attrib.exe
2924	attrib.exe
2648	attrib.exe
2708	attrib.exe
3472	attrib.exe
3396	attrib.exe
1624	attrib.exe
3436	attrib.exe

C:\Users\Admin\AppData\Local\Temp\shadowsnoser.exe
"C:\Users\Admin\AppData\Local\Temp\shadowsnoser.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @webrateboyanaana 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2924
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3472
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @webrateboyanaana 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2648
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @webrateboyanaana 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3360
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @webrateboyanaana 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3436
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @webrateboyanaana 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4176
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @webrateboyanaana 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4848
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5292
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4960

C:\Users\Admin\AppData\Local\Temp\shadowsnoser.exe
"C:\Users\Admin\AppData\Local\Temp\shadowsnoser.exe"
1⤵
PID:424

C:\Users\Admin\AppData\Local\Temp\shadowsnoser.exe
"C:\Users\Admin\AppData\Local\Temp\shadowsnoser.exe" -startup
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Desktop\info-Locker.txt
Size 83B
SHA256 056cc0098be7fbe376d8f7c42fa8a0d7b509f5b35bc2168a7d0e0bf14c7b0dd2
MD5 b598c5abc8a8dc14feff0b6906342fa8
SHA1 7ef60d4ce6713761a9c2cb2183e24faf9efb3de9
SHA512 ec68b5e055a2e3e97628929bb5853e8857358c45048f3940cbf873e344e950203a98141be3432bf71f36fa3f96afdfd6e1645ec12136cb765835d6762546866e
TLSH
T196A012083D183A44311010F33A32B001146DA91C1007184311050852306108054DF525
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Documents\info-Locker.txt
Size 83B
SHA256 9f5aa83254481e29255b61be462fc4de0037594ec5fb21630ea56f222fbe03d9
MD5 da9c9ee062a4d41cf9caa85a9b011ee5
SHA1 8e675e7db844b3bf966d8e7403c568a6cd5a6588
SHA512 af67c9aa5cb2ebee122b2d4d0e258ba9f6a5a9caababe275d71630baeca5e569268dbf67d5a63dcd2376890f75ac8b01d71a09d7274a177612e0738f498143cc
TLSH
T113A012083D183AC4210010F37A31B001546CA90C20071C421105086330650C054DF520
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 83B
SHA256 ecece163a50447c63e360fa5cf5dc33ae59e1409c6dd6cfd80c9883695445d6e
MD5 773b6b739aa42f8095b603406108afd5
SHA1 8f14784289e77bfd0f977751342760f24f15e310
SHA512 92495e34fbe0ee0ef99c0919f7c956244d7687d9c946ebea518f1c222e3d96410f763c55d6dc09de3abd899dcaca4657cd1a73261a321e6f794baf7c6f386e3c
TLSH
T1FDA012083D183A84210010F33A31B001186DA90D1007184111040866306108064DF530
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2340-5-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-0-0x00007FFB336DF000-0x00007FFB336E0000-memory.dmp

Download

memory/2340-1-0x0000000000DD0000-0x0000000000E0C000-memory.dmp

Download

memory/2340-6-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-7-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-8-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-12-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-3-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-2-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-4-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-25-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-26-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-27-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-28-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-29-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-30-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download

memory/2340-31-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp

Download