Malware Analysis Report

2024-08-06 13:57

Sample ID 240617-rz9vwaycjr
Target WinLocker Builder v1.4.exe
SHA256 60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f
Tags
aspackv2 modiloader trojan persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f

Threat Level: Known bad

The file WinLocker Builder v1.4.exe was found to be: Known bad.

Malicious Activity Summary

aspackv2 modiloader trojan persistence upx

ModiLoader, DBatLoader

ModiLoader Second Stage

Executes dropped EXE

UPX packed file

Checks computer location settings

ASPack v2.12-2.42

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-17 14:39

Signatures

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 14:39

Reported

2024-06-17 15:10

Platform

win10-20240404-en

Max time kernel

1791s

Max time network

1593s

Command Line

"C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe

"C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp

Files

memory/2908-0-0x0000000000400000-0x0000000000545000-memory.dmp

memory/2908-1-0x00000000006E0000-0x00000000006E1000-memory.dmp

memory/2908-2-0x0000000000400000-0x0000000000545000-memory.dmp

memory/2908-4-0x00000000006E0000-0x00000000006E1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 14:39

Reported

2024-06-17 15:10

Platform

win7-20240611-en

Max time kernel

1791s

Max time network

1566s

Command Line

"C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe

"C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe"

Network

N/A

Files

memory/2208-0-0x0000000000400000-0x0000000000545000-memory.dmp

memory/2208-1-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2208-2-0x0000000000400000-0x0000000000545000-memory.dmp

memory/2208-4-0x0000000000230000-0x0000000000231000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-17 14:39

Reported

2024-06-17 14:40

Platform

debian9-armhf-20240418-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-17 14:39

Reported

2024-06-17 14:40

Platform

debian9-mipsbe-20240611-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-17 14:39

Reported

2024-06-17 15:10

Platform

win10v2004-20240226-en

Max time kernel

1801s

Max time network

1802s

Command Line

"C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Upx.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\123123.exe = "C:\\Users\\Admin\\Desktop\\123123.exe" C:\Users\Admin\Desktop\123123.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000090000000 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656} C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A
N/A N/A C:\Users\Admin\Desktop\123123.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3256 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe C:\Users\Admin\AppData\Local\Temp\Upx.exe
PID 3256 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe C:\Users\Admin\AppData\Local\Temp\Upx.exe
PID 3256 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe C:\Users\Admin\AppData\Local\Temp\Upx.exe

Processes

C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe

"C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Users\Admin\AppData\Local\Temp\Upx.exe

"C:\Users\Admin\AppData\Local\Temp\Upx.exe" "C:\Users\Admin\Desktop\123123.exe"

C:\Users\Admin\Desktop\123123.exe

"C:\Users\Admin\Desktop\123123.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2152 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 31.251.17.2.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
DE 142.250.186.106:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 106.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 i.pki.goog udp
US 8.8.8.8:53 i.pki.goog udp
US 8.8.8.8:53 i.pki.goog udp
US 8.8.8.8:53 i.pki.goog udp
DE 172.217.18.3:80 i.pki.goog tcp
US 8.8.8.8:53 3.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 93.65.42.20.in-addr.arpa udp

Files

memory/3256-0-0x0000000000400000-0x0000000000545000-memory.dmp

memory/3256-1-0x0000000000870000-0x0000000000871000-memory.dmp

memory/3256-2-0x0000000000400000-0x0000000000545000-memory.dmp

memory/3256-3-0x0000000000400000-0x0000000000545000-memory.dmp

memory/3256-4-0x0000000000870000-0x0000000000871000-memory.dmp

memory/3256-5-0x0000000000400000-0x0000000000545000-memory.dmp

C:\Users\Admin\Desktop\123123.exe

MD5 7335fc512377e72533c3d6c182c7f109
SHA1 a775ae9c569d590b6a5b26fc76a4d0f606ef68db
SHA256 79b94a3e044f115fd41e2af3b885726054d82568e7871e92d34404feb1d7cf54
SHA512 9132af7d45abf14baa9d2bb1e2c2dec85a4d8cfc45419be4914b03d24cb9e6483c12bf8931eb7e177708356aa1e6b4b29f3805455eebc13f249beb1078c7078e

C:\Users\Admin\AppData\Local\Temp\Upx.exe

MD5 308f709a8f01371a6dd088a793e65a5f
SHA1 a07c073d807ab0119b090821ee29edaae481e530
SHA256 c0f9faffdf14ab2c853880457be19a237b10f8986755f184ecfe21670076cb35
SHA512 c107f1af768d533d02fb82ae2ed5c126c63b53b11a2e5a5bbf45e396cb7796ca4e7984ce969b487ad38d817f4d4366e7953fb555b279aa019ffb5d1bbba57e28

memory/3140-38-0x0000000000400000-0x000000000057E000-memory.dmp

memory/3140-59-0x0000000000400000-0x000000000057E000-memory.dmp

memory/3256-60-0x0000000000400000-0x0000000000545000-memory.dmp

C:\Users\Admin\Desktop\123123.exe

MD5 5db99ff87758e0b820d0bcc3ac1acea3
SHA1 1e450845af3a9a065345c97d6036f50104051645
SHA256 5ce50208bfc92741fd650d5a99a3a08d9b6b3336472eb49153fc3d937b4f49f8
SHA512 fe0ac4d1c43565cf8e8af353d0b34cfa99e41402612ab38cdbb01a010c342db2db7a3f3c9d37dd9e1d0f529d613c451f8f38c5fdd620a865da5aeffef116da29

memory/4048-62-0x0000000000400000-0x000000000046B000-memory.dmp

memory/4048-64-0x0000000000940000-0x0000000000941000-memory.dmp

memory/4048-66-0x0000000000400000-0x000000000046B000-memory.dmp

memory/4048-69-0x0000000000400000-0x000000000046B000-memory.dmp

memory/4048-71-0x0000000000400000-0x000000000046B000-memory.dmp

memory/4048-123-0x0000000000400000-0x000000000046B000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-17 14:39

Reported

2024-06-17 14:40

Platform

win11-20240419-en

Max time kernel

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe

"C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe"

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

Network

N/A

Files

memory/5036-0-0x0000000000400000-0x0000000000545000-memory.dmp

memory/5036-1-0x0000000000A20000-0x0000000000A21000-memory.dmp

memory/5036-2-0x0000000000400000-0x0000000000545000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 18951ad4190ed728ba23e932e0c6e0db
SHA1 fa2d16fcbc3defd07cb8f21d8ea4793a21f261f0
SHA256 66607b009c345a8e70fc1e58ab8a13bbea0e370c8d75f16d2cce5b876a748915
SHA512 a67237089efa8615747bdc6cfe0afc977dc54cfd624a8d2e5124a441c204f1ec58ee7cfbbc105ddc2c18d4f254b9e124d71630bcdba0253d41a96890104f2fff

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-17 14:39

Reported

2024-06-17 14:40

Platform

ubuntu1804-amd64-20240611-en

Max time kernel

0s

Max time network

0s

Command Line

[/tmp/WinLocker Builder v1.4.exe]

Signatures

N/A

Processes

/tmp/WinLocker Builder v1.4.exe

[/tmp/WinLocker Builder v1.4.exe]

Network

Country Destination Domain Proto
GB 185.125.188.61:443 tcp
GB 185.125.188.61:443 tcp
US 151.101.193.91:443 tcp
US 151.101.193.91:443 tcp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-17 14:39

Reported

2024-06-17 14:40

Platform

debian9-mipsel-20240418-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A