LokiLocker

The following figure shows that the LokiLocker ransomware registers itself to the task scheduler and registry under the name”Loki” before it starts its encryption process.

The ransomware creates a Task Scheduler for the " winlogon.exe " file to ensure it is able to execute each time a user logs into the system for persistence.

These include: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet

The following figure shows that the LokiLocker ransomware registers itself to the task scheduler and registry under the name”Loki” before it starts its encryption process.

The ransomware creates a Task Scheduler for the " winlogon.exe " file to ensure it is able to execute each time a user logs into the system for persistence.

the malware creates a batch file that contains a code of registry modification to disable the task manager.

the attacker takes an additional step by creating a new local user account, assigning it the name ' Microsoft '

The following figure shows that the LokiLocker ransomware registers itself to the task scheduler and registry under the name”Loki” before it starts its encryption process.

The following figure shows that the LokiLocker ransomware registers itself to the task scheduler and registry under the name”Loki” before it starts its encryption process.

The ransomware creates a Task Scheduler for the " winlogon.exe " file to ensure it is able to execute each time a user logs into the system for persistence.

The following figure shows that the LokiLocker ransomware registers itself to the task scheduler and registry under the name”Loki” before it starts its encryption process.

if the privilege is not available, the malware will attempt to request administrative access through the User Account Control (UAC).

The malware is written in .NET and protected with NETGuard ... while also using KoiVM, a virtualization plugin. The use of KoiVM as a protector is an unusual method for complicating analysis of the malware...

The malware... may have the ability to display a false flag tactic that blames Iranian actors... it's not clear if the bug actually originates from Iran or the authors are trying to feint tracking.

Afterward, it carries out actions such as deleting volume shadows to prevent recovery, as well as behaviors aimed at obstructing detection and leaking information.

Upon execution, the malware initiates a function where it checks for the presence of any existing mutex within the compromised host.

Then the malware set the copied file as hidden to conceal it from the victim or user

the malware creates a batch file that contains a code of registry modification to disable the task manager.

The threat actor initiates the breach by employing a brute force attack, successfully compromising the user " Administrator ".

It’s possible that the LokiLocker version via brute-checker hacking tools used to automate validation of stolen accounts and gain access to other accounts with credential stuffing.

the malware initiates by retrieving a comprehensive list of all services running on the system.

The ransomware proceeds with the next activity, terminating several processes... The ransomware enumerates all running processes

The malware made POST request communication, with information such as unique-id, disk-size, affiliate username, CPU-name, ram-size, and os-name

The ransomware uses a combination of AES for file encryption and RSA for key protection to encrypt documents on victims' local hard drives and network shares.

Upon execution, the malware initiates a function where it checks for the presence of any existing mutex within the compromised host.

During the initial access phase, the attacker with IP Address 87.251.75.145 started brute-forcing activities targeting the RDP machine and successfully login as a local user named Administrator.

The malware made POST request communication ... to the url path /api/index.php hosted on the command-and-control (C2) server hosted on domain application-api.xyz.

the attacker utilizes the copy-and-paste feature available in the Windows RDP software to place a malicious file named " svchost.exe " directly into the Desktop folder

The ransomware uses a combination of AES for file encryption and RSA for key protection to encrypt documents on victims' local hard drives and network shares.

Once the potentially disruptive services are identified, the malware takes action by stopping the services.

In addition, after overwriting the MBR, the ransomware will try to crash the system by forcing a Blue Screen of Death.

the ransomware changes the compromised host's wallpaper background, replacing it with their custom wallpaper.

Should the victim refuse to pay, LokiLocker also has wiper functionality to delete non-system files to make the system unusable.

However, if configured to do so, the malware also includes a wiper function that will erase the data if the payment deadline passes. It will delete files on all of the victim's drives, except for the system files.

The attacker first added exclusion folders in Windows Defender for " Program Files " and the user folder, allowing malware to execute without being blocked

the ransomware attempts to disable the firewall through the following commands: "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off