Malware

RegretLocker

RegretLocker is a Windows ransomware family identified in 2020 that is notable for encrypting the contents of mounted virtual hard disks rather than only encrypting ordinary files on accessible volumes. It specifically searches for virtual disk image formats used in Windows and Hyper-V environments, mounts those images through the Windows Virtual Storage API, and then encrypts the files inside them individually. This approach improves speed and effectiveness against large virtual disk containers and can significantly impact virtualized workloads and backup media.

RegretLocker encrypts victim data with AES and protects the symmetric key with RSA. It retrieves an RSA public key from attacker-controlled infrastructure over Tor, while some observed samples also contain a hard-coded fallback RSA key used when command-and-control is unreachable. The malware appends a distinct extension to encrypted files and drops ransom notes in affected locations.

The ransomware is designed to maximize file access and hinder recovery. It deletes shadow copies and backup-related data, disables recovery options, and attempts to terminate processes or services that keep files open. Observed samples use the Windows Restart Manager API and command-line process termination to close locking applications while excluding certain system-critical or operator-useful processes. RegretLocker also mounts fixed, removable, and remote volumes, encrypts USB-accessible data, and includes functionality to enumerate SMB-accessible systems and folders for encryption of reachable network shares.

Persistence has been observed through both autorun configuration and a scheduled task. RegretLocker also checks for an existing instance of itself before proceeding. Some samples extract an auxiliary Tor communication component and use it to send host information, obtain cryptographic material, and signal encryption status.

RegretLocker is associated with financially motivated extortion activity rather than espionage. Its tradecraft shows emphasis on operational efficiency, recovery inhibition, and impact against enterprise environments that rely on virtual disks, shared storage, and backups.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

Next, it also schedules the malware as a task every minite using this Schtasks.exe command... schtasks /Create /SC MINUTE /TN "Mouse Application" /TR "RegretLocker_path" /f

T1059.003Windows Command ShellEvidence1

The malware builds and executes this command from cmd.exe . cmd.exe /C wmic SHADOWCOPY DELETE & wbadmin DELETE SYSTEMSTATEBACKUP & bcdedit.exe / set{ default } bootstatuspolicy ignoreallfailures & bcdedit.exe / set{ default } recoveryenabled No

T1129Shared ModulesEvidence1

After extracting the dll, it calls LoadLibrary to get a handle to the dll. This handle will be used for the malware to contact C&C.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

Next, it also schedules the malware as a task every minite using this Schtasks.exe command... schtasks /Create /SC MINUTE /TN "Mouse Application" /TR "RegretLocker_path" /f

T1547.001Registry Run Keys / Startup FolderEvidence1

For persistence, the malware set the registry SOFTWARE\Microsoft\Windows\CurrentVersion\Run to the path of the malware. This ensures that the malware is automatically run every time the user logs into the machine.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

Next, it also schedules the malware as a task every minite using this Schtasks.exe command... schtasks /Create /SC MINUTE /TN "Mouse Application" /TR "RegretLocker_path" /f

T1547.001Registry Run Keys / Startup FolderEvidence1

Stealth

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

The malware writter has 2 weird checks to check for a particular user name and PC name( WIN-295748OMAKG ). If the user name or the PC name matches, the malware will exit immediately.

Discovery

6 techniques

T1046Network Service DiscoveryEvidence1

There is a class called smb_scanner . The SMB function tries SMB scanning to find Adapter names and address ranges on the adapter NetServers’s IP addresses and machine names on the server using NetServerEnum .

T1057Process DiscoveryEvidence1

RegretLocker first check if there is only one version of itself running by looping through all of the running processes using CreateToolhelp32Snapshot, Process32First, and Process32Next.

T1082System Information DiscoveryEvidence1

RegretLocker contacts the C&C server... Sending information such as the computer's IP, name, volume of the disks,.. Before contacting C&C, it sends a GET request to http://api.ipify.org/ to retrieve the PC’s public IP address.

T1083File and Directory DiscoveryEvidence1

small_encrypt() calls a wrapper function to navigate around directories and files before encrypting them... If the file type is FILE_ATTRIBUTE_DIRECTORY, it will calls a recursive encrypting function to recursively go through every layer inside the folder.

T1120Peripheral Device DiscoveryEvidence1

RegretLocker uses an interesting technique of mounting a virtual disk file so each of its files can be encrypted individually.

T1497Virtualization/Sandbox EvasionEvidence1

The malware writter has 2 weird checks to check for a particular user name and PC name( WIN-295748OMAKG ). If the user name or the PC name matches, the malware will exit immediately.

Lateral Movement

1 technique

T1021.002SMB/Windows Admin SharesEvidence1

The SMB function tries SMB scanning... using NetServerEnum . The result value is a buffer of all the SMB folders in string form. Then, it goes through a while loop calling a function to encrypt these SMB folders

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

RegretLocker contacts the C&C server at http://regretzjibibtcgb.onion/input through Tor 3 times: - Retrieve RSA key from server - Sending information such as the computer's IP, name, volume of the disks,.. - Signalling when it finishes encrypting

T1105Ingress Tool TransferEvidence1

The malware extracts the path to the current directory... drops this dll in the same directory of the malware... After extracting the dll, it calls LoadLibrary to get a handle to the dll. This handle will be used for the malware to contact C&C.

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence2

RegretLocker is a new ransomware that has been found in the wild... it will particularly search for VHD files, mount them using Windows Virtual Storage API, and then encrypt all the files it finds inside of those VHD files.

T1489Service StopEvidence2

Then it will attempt the encryption again... RegretLocker then builds the command string taskkill /F /IM \process_name and runs it with cmd.exe . This command basically just filters out the process with the given process name and terminates it.

T1490Inhibit System RecoveryEvidence1

wmic SHADOWCOPY DELETE : This will delete all of the shadow copies... wbadmin DELETE SYSTEMSTATEBACKUP : Delete system backup... bcdedit.exe ... recoveryenabled No : Make sure the system can’t be recovered.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

uri●●●●●●●●●●●●View more in app6 years ago

domain●●●●●●●●●●●●View more in app6 years ago

hash.sha256●●●●●●●●●●●●View more in app6 years ago

hash.md5●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

vmray blogNews

Dec 15, 2020

Hentai Oniichan Ransomware (Berserker Variant) | Malware Analysis Spotlight - VMRay

A ransomware family mentioned for comparison that targets virtual disk image files by mounting them and encrypting the data inside.

chuongdong blogNews

Nov 17, 2020

RegretLocker | Chuong Dong

Ransomware that encrypts files with AES using an RSA-protected key, appends the .mouse extension, drops ransom notes, deletes backups and shadow copies, establishes persistence, scans SMB shares and removable drives, and uniquely mounts VHD virtual disks to encrypt files inside them for faster large-disk impact.

bleeping computerNews

Nov 3, 2020

New RegretLocker ransomware targets Windows virtual machines

Ransomware that appends the .mouse extension, mounts VHD/VHDX virtual disks via the Windows Virtual Storage API so files inside can be encrypted individually, and uses the Windows Restart Manager API to terminate processes or services locking files during encryption while avoiding certain process names.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RegretLocker