21b68a41377903e8b87a6de8fcfd1d75fef827fa960c204b55e28503f1fe50fd

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
locker.exe
Size 677KB
Sample260919-phkhjsz1ew
SHA256 21b68a41377903e8b87a6de8fcfd1d75fef827fa960c204b55e28503f1fe50fd
MD5 8e8847b337ed66f537973e029d3642c1
SHA1 16a087709c17e1d7653aeeacaced98d49233a9ba
SHA512 1f5dae8e29f45152d1a10d587b0422cd949f2bede39f805594707ca17aa83b3b259854bbc8fbdc950c568f745a11e35bbdbaec46062a3d1bf15d29243ed0dce4
SSDEEP 6144:++t5qHW9Km7+jVgLUNvG04mZeuXACtH14N86GdJ5ukTe86BBHUWq+9yN86IpKIGY:QWkV/XACt+N+KfSHd6fXQFSmrQ0e
TLSH
T124E4D543269B1DBADDD32F7861DB233AAB35FD608BBA4A6B8544C2314C131D06D2FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocks application from running via registry modification 16 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "powershell.exe"	locker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "*.exe"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "*.cmd"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "cmd.exe"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "*.cmd"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "*.ps1"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "powershell.exe"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "*.bat"	locker.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "*.bat"	locker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "*.exe"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "*.ps1"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "cmd.exe"	locker.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLocker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\locker.exe"	locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLocker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\locker.exe"	locker.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3228	cmd.exe
2288	cmd.exe
676	cmd.exe
1436	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001
Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5868	locker.exe
Token: SeDebugPrivilege	5340	locker.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5868	locker.exe
5868	locker.exe
5340	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe
5868	locker.exe
5340	locker.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 676	5868	locker.exe	89
PID 676 wrote to memory of 3372	676	cmd.exe	90
PID 3372 wrote to memory of 3376	3372	net.exe	91
PID 5868 wrote to memory of 1436	5868	locker.exe	92
PID 1436 wrote to memory of 1108	1436	cmd.exe	93
PID 1108 wrote to memory of 3928	1108	net.exe	94
PID 5340 wrote to memory of 3228	5340	locker.exe	97
PID 3228 wrote to memory of 5988	3228	cmd.exe	98
PID 5988 wrote to memory of 5520	5988	net.exe	99
PID 5340 wrote to memory of 2288	5340	locker.exe	100
PID 2288 wrote to memory of 2464	2288	cmd.exe	101
PID 2464 wrote to memory of 3056	2464	net.exe	102

C:\Users\Admin\AppData\Local\Temp\locker.exe
"C:\Users\Admin\AppData\Local\Temp\locker.exe"
1⤵
- Blocks application from running via registry modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup Administrators Admin /delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\system32\net.exe
    net localgroup Administrators Admin /delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators Admin /delete
      4⤵
      PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup Guests Admin /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\system32\net.exe
    net localgroup Guests Admin /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Guests Admin /add
      4⤵
      PID:3928

C:\Users\Admin\AppData\Local\Temp\locker.exe
C:\Users\Admin\AppData\Local\Temp\locker.exe
1⤵
- Blocks application from running via registry modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup Administrators Admin /delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\system32\net.exe
    net localgroup Administrators Admin /delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators Admin /delete
      4⤵
      PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup Guests Admin /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\system32\net.exe
    net localgroup Guests Admin /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Guests Admin /add
      4⤵
      PID:3056