4ef5d27b5f41341698d3a27e4cca6526dafcafa300cf5ac4dc050227ae69f5fb

Reason

Machine shutdown

General

Target
WinLocker.exe
Size 3.0MB
Sample261017-ryjmasvxex
SHA256 4ef5d27b5f41341698d3a27e4cca6526dafcafa300cf5ac4dc050227ae69f5fb
MD5 ce3678888a5212a6a508a9d025b0681e
SHA1 e55ab28b42148b91a81da3b6484cae01d25a2df8
SHA512 75d870da969827d2ac21b43f1abdf42e3e20320dce58952204cd2f38d7afa28d66a646d7dccba2a648d3c3c68a31092427cc79f1db7411a06573104fb17d5da3
SSDEEP 49152:+/6ASCp9av0vf4dr4sKIxDJJzRncR1Q+Bj3KevGEEre:Oav0vf4dBDjzRncR1Vt3KevGEEre
TLSH
T18BE5194369DB0CE5CED26BB465D71335A734FD72CA291F3BAA08C2316D636C4AD1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	WinLocker.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe	WinLocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3792	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemLock = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	WinLocker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SystemLockOnce = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	WinLocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1436	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "20"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3076	WinLocker.exe
3076	WinLocker.exe
3076	WinLocker.exe
3076	WinLocker.exe
3076	WinLocker.exe
3076	WinLocker.exe
3076	WinLocker.exe
3076	WinLocker.exe
3076	WinLocker.exe
3076	WinLocker.exe
3076	WinLocker.exe
3076	WinLocker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2640	OpenWith.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3076	WinLocker.exe
3076	WinLocker.exe
2640	OpenWith.exe
4792	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1436	3076	WinLocker.exe	100

C:\Users\Admin\AppData\Local\Temp\WinLocker.exe
"C:\Users\Admin\AppData\Local\Temp\WinLocker.exe"
1⤵
- Checks computer location settings
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WinLocker.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:1436

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:3792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2640

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38f4055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Masquerading

1

T1036

Match Legitimate Name or Location

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinLocker.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\WinLocker.exe.bat
Size 144B
SHA256 5e26a229c7bf27664560e7782e88f2255784e65f48632407578719764dd79118
MD5 c3c14c794e4eb20d65ad9988beee16b4
SHA1 204877e2480da3191e692d99abaeb78960e75166
SHA512 32f5519820a70c7ef992525aa73c0775912accfa4c889e56c6eda7a0e8efd81c29fa340a5ce938eb906915457b4d58163d4769d98048506f5cae768a9c35a49b
TLSH
T131C08C05409B8A99641038670AB610AD90B508BC3B482B03C322C04A90AA00CA38AB40
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
Size 3.0MB
SHA256 4ef5d27b5f41341698d3a27e4cca6526dafcafa300cf5ac4dc050227ae69f5fb
MD5 ce3678888a5212a6a508a9d025b0681e
SHA1 e55ab28b42148b91a81da3b6484cae01d25a2df8
SHA512 75d870da969827d2ac21b43f1abdf42e3e20320dce58952204cd2f38d7afa28d66a646d7dccba2a648d3c3c68a31092427cc79f1db7411a06573104fb17d5da3
SSDEEP 49152:+/6ASCp9av0vf4dr4sKIxDJJzRncR1Q+Bj3KevGEEre:Oav0vf4dBDjzRncR1Vt3KevGEEre
TLSH
T18BE5194369DB0CE5CED26BB465D71335A734FD72CA291F3BAA08C2316D636C4AD1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3076-5-0x00007FF7B6F80000-0x00007FF7B70F2000-memory.dmp

Download

memory/3076-10-0x00007FF7B6F80000-0x00007FF7B70F2000-memory.dmp

Download

memory/3792-4-0x00007FF7442A0000-0x00007FF744412000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads