Executive Summary
LCRYX is a complex VBScript-based ransomware that integrates multiple aggressive evasion and persistence techniques. It operates as both a destructive locker and a network worm, using Windows Management Instrumentation (WMI) to propagate across local subnets and infect removable media. The malware is designed to systematically dismantle system defenses by disabling Windows Defender, firewalls, and third-party antivirus solutions like Bitdefender and Kaspersky.
Technically, LCRYX achieves persistence by modifying the Winlogon Shell and Run registry keys, and it secures its presence by hijacking the cmd.exe debugger. Beyond encryption, it performs disruptive 'annoyware' activities, such as ejecting CD trays, swapping mouse buttons, and initiating high-volume ICMP flood attacks (DoS) against local gateways and external domains. The script also acts as a downloader for secondary payloads, including known stealers and loaders such as Amadey, StealC, and SmokeLoader.
This threat poses a significant risk to organizational availability and data confidentiality. Its ability to spread laterally through internal networks and automate the deletion of shadow copies and backup catalogs necessitates immediate attention for network segmentation and endpoint hardening.