Analysis
- user interaction
yes - max time kernel
36s - max time network
41s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
18/04/2026, 22:31
General
- Target skid_locker.exe
- Size 1.4MB
- Sample260418-2ffsssg12k
- SHA256 9c745f95a09b37bc0486bf0f92aad4a3d5548a939c086b93d6235d34648e683f
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Disables Task Manager via registry modification
- Disables one or more Microsoft Defender components 1 TTPs 2 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Impair Defenses: Safe Mode Boot 1 TTPs 4 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\skid_locker.exe"C:\Users\Admin\AppData\Local\Temp\skid_locker.exe"1⤵
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\skid_locker.exeC:\Users\Admin\AppData\Local\Temp\skid_locker.exe1⤵
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_n1fjpytv.aws.ps1
memory/696-24-0x0000025E00000000-0x0000025E001A1000-memory.dmp
memory/696-25-0x0000025E01A60000-0x0000025E01A6C000-memory.dmp
memory/2392-13-0x00000255783E0000-0x00000255783EC000-memory.dmp
memory/2392-12-0x00000255769A0000-0x0000025576B41000-memory.dmp
memory/2392-1-0x0000025578980000-0x0000025578990000-memory.dmp
memory/2392-7-0x0000025578B60000-0x0000025578B82000-memory.dmp
memory/2392-0-0x0000025578980000-0x0000025578990000-memory.dmp
memory/2540-34-0x00007FF61BC90000-0x00007FF61BDFB000-memory.dmp
memory/2540-27-0x000002B58A150000-0x000002B58A2F1000-memory.dmp
memory/2540-30-0x00007FF61BC90000-0x00007FF61BDFB000-memory.dmp
memory/2540-26-0x00007FF61BC90000-0x00007FF61BDFB000-memory.dmp
memory/2540-35-0x000002B58A150000-0x000002B58A2F1000-memory.dmp
memory/4184-28-0x00007FF61BC90000-0x00007FF61BDFB000-memory.dmp
memory/4184-29-0x00000277CACB0000-0x00000277CAE51000-memory.dmp
memory/4184-38-0x00007FF61BC90000-0x00007FF61BDFB000-memory.dmp
memory/4184-39-0x00000277CACB0000-0x00000277CAE51000-memory.dmp