ad861f41bb4a31ee778bf60cecf0a7bdd9c0cc91d5cc17775d15199c214fbccf

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2024, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OsLock.exe
Size

385KB
MD5

675ea787630f596da0474830ffb49723
SHA1

c8e18cbc3cca1ded47eb5860a71b9f22d46409e1
SHA256

ad861f41bb4a31ee778bf60cecf0a7bdd9c0cc91d5cc17775d15199c214fbccf
SHA512

fa3c2c6edd3435bd16ec652c1738695cd1e8cdbd010b55fd856cefdbebd50552074d06e9b66860fae9c3a2f71ffe1076bb0227944b49286f05e1a3a4c871014d
SSDEEP

6144:Z1IE/9oydPc4IvjTZlyZsDDyr3rAUp48zUCpM69/KImQi/6ebkY:Z1vlc4IrTZlyGDc54

Score

10^/10

defense_evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OsLock.exe\""	OsLock.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OsLock.exe\" -startup"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OsLock.exe\" --init"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OsLock.exe\" /setup"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OsLock.exe\""	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OsLock.exe\" --wininit"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	OsLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	OsLock.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4780	cmd.exe
2032	cmd.exe
4024	cmd.exe
1728	cmd.exe
1268	cmd.exe
2488	cmd.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2200	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4892	OsLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	OsLock.exe
Token: SeDebugPrivilege	2200	taskkill.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 1268	4892	OsLock.exe	83
PID 4892 wrote to memory of 1268	4892	OsLock.exe	83
PID 4892 wrote to memory of 4024	4892	OsLock.exe	84
PID 4892 wrote to memory of 4024	4892	OsLock.exe	84
PID 4892 wrote to memory of 1728	4892	OsLock.exe	85
PID 4892 wrote to memory of 1728	4892	OsLock.exe	85
PID 4892 wrote to memory of 2488	4892	OsLock.exe	86
PID 4892 wrote to memory of 2488	4892	OsLock.exe	86
PID 4892 wrote to memory of 4780	4892	OsLock.exe	87
PID 4892 wrote to memory of 4780	4892	OsLock.exe	87
PID 4892 wrote to memory of 2032	4892	OsLock.exe	88
PID 4892 wrote to memory of 2032	4892	OsLock.exe	88
PID 4892 wrote to memory of 2200	4892	OsLock.exe	89
PID 4892 wrote to memory of 2200	4892	OsLock.exe	89
PID 1728 wrote to memory of 3188	1728	cmd.exe	97
PID 1728 wrote to memory of 3188	1728	cmd.exe	97
PID 2488 wrote to memory of 2956	2488	cmd.exe	98
PID 2488 wrote to memory of 2956	2488	cmd.exe	98
PID 4780 wrote to memory of 212	4780	cmd.exe	99
PID 4780 wrote to memory of 212	4780	cmd.exe	99
PID 2032 wrote to memory of 2316	2032	cmd.exe	100
PID 2032 wrote to memory of 2316	2032	cmd.exe	100
PID 1268 wrote to memory of 4944	1268	cmd.exe	101
PID 1268 wrote to memory of 4944	1268	cmd.exe	101
PID 4024 wrote to memory of 5008	4024	cmd.exe	102
PID 4024 wrote to memory of 5008	4024	cmd.exe	102
PID 2488 wrote to memory of 536	2488	cmd.exe	103
PID 2488 wrote to memory of 536	2488	cmd.exe	103
PID 2032 wrote to memory of 1888	2032	cmd.exe	104
PID 2032 wrote to memory of 1888	2032	cmd.exe	104
PID 4780 wrote to memory of 3900	4780	cmd.exe	105
PID 4780 wrote to memory of 3900	4780	cmd.exe	105
PID 1268 wrote to memory of 836	1268	cmd.exe	106
PID 1268 wrote to memory of 836	1268	cmd.exe	106
PID 1728 wrote to memory of 4732	1728	cmd.exe	107
PID 1728 wrote to memory of 4732	1728	cmd.exe	107
PID 4024 wrote to memory of 4636	4024	cmd.exe	108
PID 4024 wrote to memory of 4636	4024	cmd.exe	108

Views/modifies file attributes 1 TTPs 12 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5008	attrib.exe
536	attrib.exe
1888	attrib.exe
836	attrib.exe
3188	attrib.exe
2316	attrib.exe
2956	attrib.exe
4732	attrib.exe
4636	attrib.exe
212	attrib.exe
4944	attrib.exe
3900	attrib.exe

C:\Users\Admin\AppData\Local\Temp\OsLock.exe
"C:\Users\Admin\AppData\Local\Temp\OsLock.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4944
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5008
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:4636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3188
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:4732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2956
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:212
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:3900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Упсик Твои файлы Зашифрованы! Пиши @N0TK4RMA 1>info-0v92.txt & attrib -h +s +r info-lox.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2316
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-lox.txt
    3⤵
    - Views/modifies file attributes
    PID:1888
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\info-0v92.txt

Filesize
56B

MD5
a7a7aa1dc2eb7b65c62d1d6ad9d928f7

SHA1
9c4068e4d309a577a10c2f1e233d620701dfb337

SHA256
2da0de605984896a6c294ad2e8aa7e2b7c8e8c6d22a985a6380ce0a7ea2a3753

SHA512
87b1a26336842fbdf0ebdb6d9bcb3a53690e45c8191459f57eee75df71916c960b61acfe98d8d808223022123310c8ce977ea1237358967e90bc3791fe2ffe58

Download Submit
memory/4892-0-0x00007FFB52293000-0x00007FFB52295000-memory.dmp

Filesize
8KB

Download
memory/4892-1-0x0000000000760000-0x00000000007C6000-memory.dmp

Filesize
408KB

Download
memory/4892-2-0x00007FFB52290000-0x00007FFB52D51000-memory.dmp

Filesize
10.8MB

Download
memory/4892-12-0x00007FFB52293000-0x00007FFB52295000-memory.dmp

Filesize
8KB

Download
memory/4892-13-0x00007FFB52290000-0x00007FFB52D51000-memory.dmp

Filesize
10.8MB

Download