Analysis
-
max time kernel
79s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2024 02:07
Static task
static1
1 signatures
General
-
Target
WinLocker Builder (test version).exe
-
Size
5.1MB
-
MD5
fb344b1c20c3d4b66efe7194fdc7299c
-
SHA1
c36ff3e29f450a7ffc58979cd51360d6db04e854
-
SHA256
f3fa585e7418f8b33bb279c72461d1822d0da9c0da673d158acfeecfd0ca6017
-
SHA512
44aad18a62c554cfa9a21dc4fe58db4f09d68d70252c59385fe54fe007e4e79172110719547e2cfd784ee98f8604561e185a0c3c05dd2443cf5cd76e92725bdb
-
SSDEEP
98304:Ex3MI+PNSOdHfY5JX+2pgGXRNe14VMAjizLIi2tEXuDS2MTozg:EE5Ri5pgGXyp0SIi2tEXu+Px
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
current-necessity.at.ply.gg:49446
Attributes
-
communication_password
c5e4e64cc9384fda09aa232c1811af0e
-
install_dir
MsSystemDriver
-
install_file
MsMpEng.exe
-
tor_process
tor
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ WinLocker Builder (test version).exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion WinLocker Builder (test version).exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion WinLocker Builder (test version).exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate WinLocker Builder (test version).exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsMpEng = "C:\\Users\\Admin\\AppData\\Local\\MsSystemDriver\\MsMpEng.exe耀" WinLocker Builder (test version).exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsMpEng = "C:\\Users\\Admin\\AppData\\Local\\MsSystemDriver\\MsMpEng.exe" WinLocker Builder (test version).exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WinLocker Builder (test version).exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 WinLocker Builder (test version).exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinLocker Builder (test version).exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local:20-10-2024 WinLocker Builder (test version).exe File opened for modification C:\Users\Admin\AppData\Local:20-10-2024 WinLocker Builder (test version).exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe -
Suspicious behavior: RenamesItself 16 IoCs
pid Process 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 4508 WinLocker Builder (test version).exe Token: SeDebugPrivilege 2028 taskmgr.exe Token: SeSystemProfilePrivilege 2028 taskmgr.exe Token: SeCreateGlobalPrivilege 2028 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4508 WinLocker Builder (test version).exe 4508 WinLocker Builder (test version).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinLocker Builder (test version).exe"C:\Users\Admin\AppData\Local\Temp\WinLocker Builder (test version).exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4508
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2028
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1376
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1