hxxps://shinolocker[.]com

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://shinolocker.com
Sample240608-kvs81aaf2x

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	ShinoLocker.exe

Executes dropped EXE 2 IoCs

pid	Process
2316	ShinoLocker.exe
5336	7ZaLgNjR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShinoLockerEncryptedFile\shell	ShinoLocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShinoLockerEncryptedFile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DXe1xhs8.exe \"%l\" "	ShinoLocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShinoLockerEncryptedFile\	ShinoLocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShinoLockerEncryptedFile\shell\open\command	ShinoLocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShinoLockerEncryptedFile\shell\open	ShinoLocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShinoLockerEncryptedFile\DefaultIcon	ShinoLocker.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.shino	ShinoLocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.shino\ = "ShinoLockerEncryptedFile"	ShinoLocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShinoLockerEncryptedFile	ShinoLocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShinoLockerEncryptedFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DXe1xhs8.exe, 0"	ShinoLocker.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\DXe1xhs8.exe\:SmartScreen:$DATA	ShinoLocker.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 945149.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
3048	msedge.exe
3048	msedge.exe
3872	identity_helper.exe
3872	identity_helper.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe
4016	msedge.exe
4016	msedge.exe
5336	7ZaLgNjR.exe
5336	7ZaLgNjR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	ShinoLocker.exe
Token: SeDebugPrivilege	5336	7ZaLgNjR.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1644	3048	msedge.exe	80
PID 3048 wrote to memory of 1644	3048	msedge.exe	80
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 3240	3048	msedge.exe	81
PID 3048 wrote to memory of 208	3048	msedge.exe	82
PID 3048 wrote to memory of 208	3048	msedge.exe	82
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83
PID 3048 wrote to memory of 4376	3048	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://shinolocker.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff936df46f8,0x7ff936df4708,0x7ff936df4718
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,11465328191520657026,17272922094421694407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5372

C:\Users\Admin\Downloads\ShinoLocker.exe
"C:\Users\Admin\Downloads\ShinoLocker.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:2316
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" localhost
  2⤵
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\7ZaLgNjR.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZaLgNjR.exe" E LRbX7O5WDDe7AlftAngstQ== W658jL02DbLXCCwV6/q5DA== "C:\Users\Admin\AppData\Local\Temp\2kJHl9.txt"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 6b995574b48c9ce83173c741933bf77461ff54019211846ce3f393293fe1069d
MD5 9851ac8b2aa4a7700be49eecc5521921
SHA1 f5bd8ce189b683fc26e3c35998b28b07c250ba30
SHA512 af560aa4854b13e4400f9e0b4d694cb2590e561b244b422246c44a82cf138c8dc4fca8224c63081579352431d556887d7804efa020041c6ac65f1ed92f457e57
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 aab8df4fca83953580a333b668176802380cc91068d9fc9fe0974706a1608da1
MD5 843d889e342d3d3c6d94978dc5b9c016
SHA1 9e068f5f5aea4408d08f98e3b731b508a7730e39
SHA512 263f4a0a7c2ed070cd197c84b4fe50208bc6b16d66867bcebb6e3566964e9555e797ff85879786d57313b2bb50c9092be5be2c3d26c1445641455ad0f62bc649
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ccb5a633a6018130687402d91a02fb0b4ffb5adbbbeb13e67bdc06ef53b4c49b
MD5 dad8e1687fcc883c1e66c0437c469e39
SHA1 d9c5aab84eaf606c83612c126dfdd4ecc4f1f169
SHA512 1ca54ef07d31ea03e4a96e11f70be1416ea46725d211f734b852d6593b90613d44840659872100290091e0ce78fecaf0fb05c7e83e8d6f9c4c748d16c7b081d6
SSDEEP 192:nIfkawkTGWM3HgRrC/FMErCVCfquaI6272ptX3XqDVg:nqckCWHrQrpYx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0d58f426423d29d7838b93df8d18f6d8eda0edb8915522259313a1907074a4ef
MD5 317061e7fa688174209780a5c4bfee3b
SHA1 1297d9dfd694c4809c8b3aac9a985d6098dc1872
SHA512 2af129da8d925d347e61c34aac51adc7fc6e7ff6168a20ae44764dfa4d54a90cdf0c8e18ac15faa961489003a8ba0425ce3d6518b40925b5137171641436086c
SSDEEP 96:nIfk8Yw1i73wpvWMoiVmdeHplwtd3ac0VDUWQyV+VDCziEwb:nIfk/wQjGWMXpW3XqDro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8cd74ae8852e2e0f27ca48a831831010c78933063993df9e13d6d03883aa4d72
MD5 83777a61a38e9abde87a52db973417ae
SHA1 682c45e0a5ded0e7c3c59a191f87eb147176efdc
SHA512 3d1dbb9a4b3a8328280781bb89f174ed912a55536b5982cbb6f30604e4ac927ae9422ab7a96a842891b3f268d0c1634454ffd76ab1ece2a213fd03bd9861b126
SSDEEP 192:nIfkrwQTGWM3suIbC/ErCVCfquaI6272ptR3XqDrg:nqpQCWrbprp2X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 bf378c47d5172aab02276cfd8b8a8d4a36352cb6c3a9aa3024ccc90ac94ad871
MD5 82b93168c52b12ca566dfd94a30079a4
SHA1 1722d14ca190655c16d76a1e72ffbc4e2a36465a
SHA512 ec22f20bbe2802f4abc18305ba93d52a1fd224ff940675d71f4ae14559391b360fd7d89e9b08c6f70706cb0591e58797fcbd38987067a70dc479107f1edd19bc
SSDEEP 192:nIfkawQTGWM32JWlC/FMErCVCfquaI6272pt33XqDrg:nqcQCWAlQrpkX
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

fc1b5292-c9ea-4637-b805-d8b2bd51037f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fc1b5292-c9ea-4637-b805-d8b2bd51037f.tmp
Size 2KB
SHA256 c0ad8fd9fedbfdd6c6589f9b2b71f8dad07de3db7272a6962f677514eeef5cb8
MD5 569a10770f1e9baf9e74f1e1302f0db0
SHA1 528b228bcbbddf8fac57570501dbacc1a450f7f8
SHA512 774aca187628b2c258689dda677ae87f4b6d18663ffebe19595999115f9b218563545550c87dfe1c3dd0829a91b7b95eea12cda766db4c114e06712b9641a186
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 aa08ceaa2880eaf1a1c7c928e238ac144942e549a9032c9f9c1584e31a8d4fd7
MD5 f68992e72d7ba3bde93c8aaa540ce24b
SHA1 f369de5db32a4edd4188659add1ffbd725972c26
SHA512 0fd473fd7ca0e6d1d400c55bc12c6a0eb35614ea71f10c0481a5930655759ae996d44839c3c648297e4f9eb6c1139d636e1fb5054a252a3bca23a168e9451b76
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8I74e2RUu0j2ZpO3z2OMD1:A9iIxuERzA83h09RZxYutYaOMWRHqlWC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 37e53c86e044153d8b6b7d4ed76cb7c1149e93752924f21c123dde65f4a29a80
MD5 775174f262c4b60cd9c964c231bdffb2
SHA1 397f41bbeb140ecac1fb7f2ea8ac1a8258417e6b
SHA512 1d64e7903327bed4a6ce8554a97e98dcac04f4dce948011d0f10cdb6992a4bf60aee31f2c8daf405c82a105cec1bc47640c15b70ce235747e0d14706eadcb520
SSDEEP 192:soCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8IF4e2RUu0jtcLgZpn3z2l:c9iIxuERzA83h09RZxYMmBaOMWRHqlWC
MD5 SHA1 SHA512 SSDEEP

Submit Download

2kJHl9.txt

Path C:\Users\Admin\AppData\Local\Temp\2kJHl9.txt
Size 10B
SHA256 e9310fe3cc31b2b4cf13358aa930dabe2d38d4d6e21d8c5c4cfc3e745362727f
MD5 bf7064b96d10ed4aefb28ec83ead5404
SHA1 fbd03ea1fe4cb3b6b3546f25f9368c45eb6d5c1e
SHA512 4875712a34d7f69841de349a3f04151a8f25aed50397ac7e3334fdfe22c6973d0d92ca80b5fa3a05d9331807400ab3562aebb7aff8f5f6d98bf2324afad53030
MD5 SHA1 SHA512

Submit Download

7ZaLgNjR.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZaLgNjR.exe
Size 12KB
SHA256 6aef2a20079a06566bb57277e587ff6de38a92f7c7feda0fb341cfaf3aa13834
MD5 c139b1b02df2bb767206a8aef33f20dd
SHA1 f577d8bd839161bf5101afb4bc553d1cdfeee7c3
SHA512 3d1b824467b21261cef637982a101f4bfa4a12d540744373d7a18cc489069e9945bffacb663934e04f30bec9ff638bb686f894e797ea02517892bf83b2ba0d4f
SSDEEP 192:9fx4jxvd8W+lp/Jf76yurzygys46IW1S5Umv2b9HTA8:Nx4b8WAh1u6VsC5UU2xzA
MD5 SHA1 SHA512 SSDEEP

Submit Download

CZ5D95.lst

Path C:\Users\Admin\AppData\Local\Temp\CZ5D95.lst
Size 175B
SHA256 c47995bb9c349fe21c8449d019c44f56c3fa02e0506e910194323ca9c9683c44
MD5 12aecbc0e2c9947a22fd12ee6183ea55
SHA1 543fdd816ba621a07369d98cf0f2fd54750edaa2
SHA512 324259f88f80a9003e1bb792eb547d2717354aaafeb497df1f30d4b072e647eac582e75a05a678e85c5d4e15df90ab9fdb30f34fd988ac9e39ce7d7499348680
MD5 SHA1 SHA512

Submit Download

CZ5D95.lst

Path C:\Users\Admin\AppData\Local\Temp\CZ5D95.lst
Size 310B
SHA256 98cce697e265b267b01ec9623abe06c44e286a564ebad166bdd2907f31c87d78
MD5 ce61d0aca8cddb0cb9da96ae75050139
SHA1 bbe2d3f6e7010b055d3bc9404aedab65a8ddef78
SHA512 44669c7c19b4c8de331a7c55eee3dc6764b514ce7d7b5ae9e540283aa858a39b36c9c6749a079c60202e09cff74c624ce789f08c5314d8ada6ca33d355b37e08
MD5 SHA1 SHA512

Submit Download

CZ5D95.lst

Path C:\Users\Admin\AppData\Local\Temp\CZ5D95.lst
Size 322B
SHA256 d52da9ace5aa7bf7388d64062419ec93a5e4b74ca5f899b335db4cca2cdb3469
MD5 a2faf4c2a667734043ee9a4d2fc08327
SHA1 dd181956f90fce9b1b9f72eff0fea7f15f19a12a
SHA512 a3b12a282eb6fc8fec9822bbdcada77390267cedb15637cfe470f50ad38ba7064cac74f69599d8ef8a6d3895add6002c0eee2e893db463c19c5c7ede3f24c0c2
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Unconfirmed 945149.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 945149.crdownload
Size 190KB
SHA256 c992f8fe3a0ab8b3446136f092fe74461057ec6d6d2c7eafa99f673f70513b03
MD5 c0293c35221b212366607b76631d760e
SHA1 09f789c0f3efa035fdd6f353fefa97f8e28a6334
SHA512 f0257d54331c5412d2831bf887fbd525f36ccfd593b0f7200d8c8e0152705c09547fc3f4255216cf6bce3927670f47950a38833f7db188f8179e2f177b2c03fc
SSDEEP 3072:06w9+FrD19ZQb5UjdPrY7zE551QGWiE55k:Publ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2316-253-0x000000001C9E0000-0x000000001CA2C000-memory.dmp

Download

memory/2316-252-0x0000000001720000-0x0000000001728000-memory.dmp

Download

memory/2316-251-0x000000001C8D0000-0x000000001C96C000-memory.dmp

Download

memory/2316-250-0x000000001C360000-0x000000001C82E000-memory.dmp

Download

memory/2316-249-0x000000001BD60000-0x000000001BE06000-memory.dmp

Download