Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
15/07/2026, 04:07
General
- Target BacteriaLocker.exe
- Size 16KB
- Sample260715-epxrcabs7k
- SHA256 c93752bc8b0ffb8660c0ed8f233253dfe8b2e749610a4c75529afa75779fe100
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Uses Session Manager for persistence 2 TTPs 2 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Drops file in System32 directory 3 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BacteriaLocker.exe"C:\Users\Admin\AppData\Local\Temp\BacteriaLocker.exe"1⤵
- Modifies WinLogon for persistence
- Uses Session Manager for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create WindowsLocker binpath= "C:\Windows\System32\WindowsLocker.exe" start= auto type= own2⤵
- Launches sc.exe
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn WindowsLocker /tr "C:\Windows\System32\WindowsLocker.exe" /sc onlogon /rl highest /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\BacteriaLocker.exeC:\Users\Admin\AppData\Local\Temp\BacteriaLocker.exe1⤵
- Modifies WinLogon for persistence
- Uses Session Manager for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create WindowsLocker binpath= "C:\Windows\System32\WindowsLocker.exe" start= auto type= own2⤵
- Launches sc.exe
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn WindowsLocker /tr "C:\Windows\System32\WindowsLocker.exe" /sc onlogon /rl highest /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsLocker.exeC:\Windows\System32\WindowsLocker.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
WindowsLocker.exe
memory/2020-10-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/2020-14-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/2020-20-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/2020-18-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/2020-12-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/2020-11-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/2020-13-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-6-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-0-0x00007FFEA592F000-0x00007FFEA5930000-memory.dmp
memory/5152-2-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-8-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-7-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-9-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-5-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-1-0x0000000000240000-0x000000000024A000-memory.dmp
memory/5152-16-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-17-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-4-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-19-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/5152-3-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp