Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 14:19
General
- Target WinLocker.exe
- Size 31KB
- Sample260704-rnb5gaf141
- SHA256 cb768759a4205a4a4307ceeedd3cb44aa9a21894d50a96cd105ac557002ec7f1
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 4 IoCs
- UAC bypass 3 TTPs 9 IoCs
- Modifies boot configuration data using bcdedit 1 TTPs 9 IoCs
- Adds policy Run key to start application 2 TTPs 8 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Disables RegEdit via registry modification 3 IoCs
- Disables Task Manager via registry modification
- Uses Session Manager for persistence 2 TTPs 3 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Creates new service(s) 2 TTPs
- Drops startup file 3 IoCs
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 18 IoCs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Drops autorun.inf file 1 TTPs 8 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 5 IoCs
- Drops file in Windows directory 12 IoCs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
- System policy modification 1 TTPs 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinLocker.exe"C:\Users\Admin\AppData\Local\Temp\WinLocker.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Uses Session Manager for persistence
- Drops startup file
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "WinLockerLogon" /TR "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /SC ONLOGON /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "WinLockerStartup" /TR "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /SC ONSTART /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "WinLockerIdle" /TR "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /SC ONIDLE /I 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create WinLocker binPath= "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" start= auto2⤵
- Launches sc.exe
-
-
C:\Windows\System32\mountvol.exe"C:\Windows\System32\mountvol.exe" S: /s2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WinLocker.exe"C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /watchdog2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\svchost_backup.exe"C:\Users\Admin\AppData\Local\Temp\svchost_backup.exe" /watchdog_backup2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost_backup.exe"C:\Users\Admin\AppData\Local\Temp\svchost_backup.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\ReAgentc.exe"C:\Windows\System32\ReAgentc.exe" /disable2⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /delete {fwxf}2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WinLocker.exeC:\Users\Admin\AppData\Local\Temp\WinLocker.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Uses Session Manager for persistence
- Drops startup file
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "WinLockerLogon" /TR "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /SC ONLOGON /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "WinLockerStartup" /TR "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /SC ONSTART /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "WinLockerIdle" /TR "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /SC ONIDLE /I 1 /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create WinLocker binPath= "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" start= auto3⤵
- Launches sc.exe
-
-
C:\Windows\System32\mountvol.exe"C:\Windows\System32\mountvol.exe" S: /s3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WinLocker.exe"C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /watchdog3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\svchost_backup.exe"C:\Users\Admin\AppData\Local\Temp\svchost_backup.exe" /watchdog_backup3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\ReAgentc.exe"C:\Windows\System32\ReAgentc.exe" /disable3⤵
- Drops file in Windows directory
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /delete {fwxf}3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinLocker.exeC:\Users\Admin\AppData\Local\Temp\WinLocker.exe1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Uses Session Manager for persistence
- Drops startup file
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "WinLockerLogon" /TR "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /SC ONLOGON /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "WinLockerStartup" /TR "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /SC ONSTART /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "WinLockerIdle" /TR "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /SC ONIDLE /I 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create WinLocker binPath= "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" start= auto2⤵
- Launches sc.exe
-
-
C:\Windows\System32\mountvol.exe"C:\Windows\System32\mountvol.exe" S: /s2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WinLocker.exe"C:\Users\Admin\AppData\Local\Temp\WinLocker.exe" /watchdog2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\svchost_backup.exe"C:\Users\Admin\AppData\Local\Temp\svchost_backup.exe" /watchdog_backup2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\ReAgentc.exe"C:\Windows\System32\ReAgentc.exe" /disable2⤵
- Drops file in Windows directory
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /delete {fwxf}2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
5Active Setup
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
5Active Setup
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
svchost_backup.exe
ReAgent.log
ReAgent.log
diagerr.xml
diagerr.xml
diagwrn.xml
diagwrn.xml
setuperr.log
ReAgent.xml
memory/2320-6-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-4-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-15-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-16-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-9-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-8-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-7-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-0-0x00007FFD5F21F000-0x00007FFD5F220000-memory.dmp
memory/2320-5-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-14-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-3-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-2-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-1-0x0000000000A40000-0x0000000000A4E000-memory.dmp
memory/2320-41-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-42-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-43-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp
memory/2320-44-0x00007FFD5F090000-0x00007FFD5FA34000-memory.dmp