fcb2971fa6dadc7c8136319dc4714671ef4d6dedd6b053424ae8136546ef4651

Analysis

user interaction
yes
max time kernel
36s
max time network
39s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 5.7MB
Sample260809-v2k63sbf37
SHA256 fcb2971fa6dadc7c8136319dc4714671ef4d6dedd6b053424ae8136546ef4651
MD5 6d0a66b65a9d87f4c2d9c849b864a4c4
SHA1 61fa365f774b9961f7974c362271a4954fb18192
SHA512 f75787a4adc2580b4f3581352ab71c93738426c142e6315cd4af1ddb51326c02b5b148c155bafdc1938e54e71ce730eff966db992587b73fdbb9058548b299ee
SSDEEP 98304:9vqmGvGWyDQJ563ouCv25J0UHKacMSLLeay6bjjqy6bjjyy6bjjc:QBnPJ564zaJ0UhvGia5O525A
TLSH
T1C6563308828A4959F07DB1B628955490CBF77E58D3628BCF28CA5BF33A07364FD257B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution persistence trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	WinLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	WindowsDefenderUpdate.exe

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WindowsDefenderUpdate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\Control Panel\International\Geo\Nation	WinLock.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\Control Panel\International\Geo\Nation	WindowsDefenderUpdate.exe

Executes dropped EXE 1 IoCs

pid	Process
5016	WindowsDefenderUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate.exe = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\WindowsDefenderUpdate.exe"	WindowsDefenderUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate.exe = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\WindowsDefenderUpdate.exe"	WinLock.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDefenderUpdate.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WinLock.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WinLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinLock.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WindowsDefenderUpdate.exe

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1332	cmd.exe
5584	cmd.exe
4724	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\winre.wim	WinLock.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4828	sc.exe
2232	sc.exe
1716	sc.exe
4916	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 37 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5160	cmd.exe
5056	cmd.exe
1916	cmd.exe
2572	cmd.exe
4296	cmd.exe
3684	cmd.exe
5676	cmd.exe
4024	cmd.exe
4276	cmd.exe
3236	cmd.exe
3732	cmd.exe
2420	cmd.exe
1072	cmd.exe
2624	cmd.exe
3756	cmd.exe
2972	cmd.exe
5368	cmd.exe
5012	cmd.exe
4808	cmd.exe
1252	cmd.exe
5084	cmd.exe
5904	cmd.exe
5380	cmd.exe
5148	cmd.exe
5956	cmd.exe
6040	cmd.exe
1108	cmd.exe
1732	cmd.exe
2592	cmd.exe
3304	cmd.exe
572	cmd.exe
6124	cmd.exe
5532	cmd.exe
4788	cmd.exe
3352	cmd.exe
1220	cmd.exe
3620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsDefenderUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4840	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
1956	WinLock.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe
5016	WindowsDefenderUpdate.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	WinLock.exe
Token: SeDebugPrivilege	5016	WindowsDefenderUpdate.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1956	WinLock.exe
5016	WindowsDefenderUpdate.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 4808	1956	WinLock.exe	83
PID 1956 wrote to memory of 5148	1956	WinLock.exe	85
PID 1956 wrote to memory of 3732	1956	WinLock.exe	87
PID 1956 wrote to memory of 1252	1956	WinLock.exe	89
PID 1956 wrote to memory of 5956	1956	WinLock.exe	91
PID 1956 wrote to memory of 4788	1956	WinLock.exe	93
PID 1956 wrote to memory of 2420	1956	WinLock.exe	95
PID 2420 wrote to memory of 4928	2420	cmd.exe	97
PID 1956 wrote to memory of 5056	1956	WinLock.exe	98
PID 1956 wrote to memory of 6040	1956	WinLock.exe	100
PID 1956 wrote to memory of 1108	1956	WinLock.exe	102
PID 1956 wrote to memory of 3352	1956	WinLock.exe	104
PID 1956 wrote to memory of 3756	1956	WinLock.exe	106
PID 1956 wrote to memory of 1072	1956	WinLock.exe	108
PID 1956 wrote to memory of 2972	1956	WinLock.exe	110
PID 1956 wrote to memory of 5368	1956	WinLock.exe	112
PID 1956 wrote to memory of 1220	1956	WinLock.exe	115
PID 1956 wrote to memory of 1332	1956	WinLock.exe	118
PID 5016 wrote to memory of 3620	5016	WindowsDefenderUpdate.exe	123
PID 5016 wrote to memory of 1732	5016	WindowsDefenderUpdate.exe	125
PID 5016 wrote to memory of 3684	5016	WindowsDefenderUpdate.exe	127
PID 5016 wrote to memory of 3304	5016	WindowsDefenderUpdate.exe	129
PID 5016 wrote to memory of 5676	5016	WindowsDefenderUpdate.exe	131
PID 5016 wrote to memory of 5084	5016	WindowsDefenderUpdate.exe	133
PID 5016 wrote to memory of 5904	5016	WindowsDefenderUpdate.exe	135
PID 5904 wrote to memory of 3728	5904	cmd.exe	137
PID 5016 wrote to memory of 4024	5016	WindowsDefenderUpdate.exe	138
PID 5016 wrote to memory of 2592	5016	WindowsDefenderUpdate.exe	140
PID 5016 wrote to memory of 572	5016	WindowsDefenderUpdate.exe	142
PID 5016 wrote to memory of 4276	5016	WindowsDefenderUpdate.exe	144
PID 5016 wrote to memory of 6124	5016	WindowsDefenderUpdate.exe	146
PID 5016 wrote to memory of 5160	5016	WindowsDefenderUpdate.exe	148
PID 5016 wrote to memory of 1916	5016	WindowsDefenderUpdate.exe	150
PID 5016 wrote to memory of 2572	5016	WindowsDefenderUpdate.exe	152
PID 5016 wrote to memory of 5380	5016	WindowsDefenderUpdate.exe	154
PID 5016 wrote to memory of 5584	5016	WindowsDefenderUpdate.exe	156
PID 1956 wrote to memory of 3236	1956	WinLock.exe	159
PID 3236 wrote to memory of 2232	3236	cmd.exe	161
PID 1956 wrote to memory of 5532	1956	WinLock.exe	162
PID 5532 wrote to memory of 1716	5532	cmd.exe	164
PID 1956 wrote to memory of 2624	1956	WinLock.exe	166
PID 2624 wrote to memory of 4916	2624	cmd.exe	168
PID 1956 wrote to memory of 4296	1956	WinLock.exe	169
PID 4296 wrote to memory of 4828	4296	cmd.exe	171
PID 1956 wrote to memory of 4872	1956	WinLock.exe	172
PID 1956 wrote to memory of 4724	1956	WinLock.exe	173
PID 4724 wrote to memory of 4324	4724	cmd.exe	175
PID 1956 wrote to memory of 5012	1956	WinLock.exe	176
PID 5012 wrote to memory of 4840	5012	cmd.exe	178

System policy modification 1 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRecovery = "1"	WinLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	WinLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRecovery = "1"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	WindowsDefenderUpdate.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config wuauserv start= demand
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= demand
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc start wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Windows\SysWOW64\sc.exe
    sc start wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start= demand
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= demand
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc start WinDefend
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\sc.exe
    sc start WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4828
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4872
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "MicrosoftUpdateTask*" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftUpdateTask*" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 2 & del "C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4840

C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe
C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5676
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4024
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsDefenderUpdate.exe

Path C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe
Size 5.7MB
SHA256 fcb2971fa6dadc7c8136319dc4714671ef4d6dedd6b053424ae8136546ef4651
MD5 6d0a66b65a9d87f4c2d9c849b864a4c4
SHA1 61fa365f774b9961f7974c362271a4954fb18192
SHA512 f75787a4adc2580b4f3581352ab71c93738426c142e6315cd4af1ddb51326c02b5b148c155bafdc1938e54e71ce730eff966db992587b73fdbb9058548b299ee
SSDEEP 98304:9vqmGvGWyDQJ563ouCv25J0UHKacMSLLeay6bjjqy6bjjyy6bjjc:QBnPJ564zaJ0UhvGia5O525A
TLSH
T1C6563308828A4959F07DB1B628955490CBF77E58D3628BCF28CA5BF33A07364FD257B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 4KB
SHA256 19ab0a968ffa1b7f23e64977b4bc86cbbe5f147eb8e2ac4b4bd6bf0612792c94
MD5 e261ad5aac790c4d42117f2a7c2a6ade
SHA1 4bcd557ebf52bf315407663e9965f502ab0a83e6
SHA512 6cd19915bce3e4c5330b9c8fa1e7cc1ac8115c1255f5fbdb0f01e21d32abc7a9c6433bf7c3718c6cead3d4eb93a95bcb8686803f3b325bc4f6b2cb97b134f815
SSDEEP 96:eMBoMBjMBoMBlsBzMBcsBzMB8sBzMBpsBzMBjsBzMB9sBzMB8sBzMBUsBzMBq2Mu:eMBoMBjMBoMBlsBzMBcsBzMB8sBzMBp/
TLSH
T1909105638E9B02FF7D0BD445E676CA5DD92321A4670E3594BA3F5489BB0A30944FED0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 13KB
SHA256 1655e8a59dea5a48aaf2883318355d911946546b2eb8a2e3cb8c68384e1e8b63
MD5 46fc18d58cf1378d39b48e13b195cd48
SHA1 831a9f285dfe8e9f161ec022e13c030200333820
SHA512 a80800620c81d3b5e5619fc5535cdf0c977f137a619aa51eb4e3722de15894d96b0619ba678230bd94aedc2a38603bbba4695ff6c135286c6a6e80976fec45f2
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbneA:53gbq3gbq3gbq3gbY3gbq3gbq3gbHFv
TLSH
T128528229B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFB239042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 17KB
SHA256 3e9b6f159d4d11be9a1d6077ad8a137859b58a60fbbce3d35d40411e471fe87d
MD5 4205acede3442cc68f7940547d47dd5e
SHA1 5fa800f04f2309342f404b5c9176c510bd43f747
SHA512 a6cd088e6cf3be27823129f2081d06af97e4de527889ba8d823433224d2d77a819fac427f8c4a739791bbb4686e9954cb47cdf452f62e6f08bb5d5a7e5cea8f4
SSDEEP 192:53gbq3gbq3gbE7cOtMd3gbY3gbq3gbEKKKKKKKA3gbEimfv:53Iq3Iq3IScZ3IY3Iq3Iy3Iy
TLSH
T125721939B1952FBB5C5046E8CFD038C26B809B794116A03794C5FDAFA279042F9B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\SysWOW64\Recovery\ReAgent.xml
Size 1KB
SHA256 0f7d35d68a237b9c7d6d24c736e9a758761bb0840c113686b81e2ce33928ef65
MD5 7ba1a1ae453e18669377cbd6eb101109
SHA1 e57bd758fffefce630ab1399876f5c50e67c7804
SHA512 7060bf7aeeaeaf1fb85f427307463ca00f3050318f8630e08a92d7be9f0a4870d8c44c3323c9b81df6f1651ad8171009c0abde3b11f766da238c785f72ba05ff
TLSH
T11311AB4681B858A6C7B1D266F1F8BD60463FF1DD02E18A5CE029F7D39447452C75F970
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1956-3-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/1956-10-0x0000000007A70000-0x0000000007AD6000-memory.dmp

Download

memory/1956-9-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/1956-12-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/1956-4-0x0000000005C00000-0x0000000005C0A000-memory.dmp

Download

memory/1956-0-0x0000000000C60000-0x000000000121A000-memory.dmp

Download

memory/1956-2-0x0000000005C10000-0x0000000005CA2000-memory.dmp

Download

memory/1956-1-0x00000000060E0000-0x0000000006686000-memory.dmp

Download

memory/1956-21-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download