{
  "family": "lockscreen",
  "sample_count": 27,
  "category": "ransomware",
  "description": "Ransomware:Win32/Lockscreen is a heuristic detection for a specific, older class of ransomware known as 'Screen Lockers'. Unlike modern crypto-ransomware that actually encrypts files, Lockscreen variants simply deny access to the Windows graphical user interface, displaying a persistent, full-screen ransom demand (often masquerading as law enforcement).<br><br><b>Understanding Lockscreen</b><br>To the victim, the effect is immediate and terrifying: their computer is completely locked down. The screen displays a message claiming the FBI or local police have detected illegal activity (e.g., piracy) and demands a 'fine' paid via Ukash, Paysafecard, or Bitcoin. For security analysts, Lockscreen malware is considered less sophisticated than crypto-ransomware. The underlying data on the hard drive remains unencrypted and perfectly intact; the malware merely prevents the user from accessing it by hijacking the Windows shell or exploiting boot mechanisms.<br><br><b>Execution and Lockdown Mechanics</b><br>Lockscreen variants (like Reveton) are typically distributed via exploit kits (`T1189`) or drive-by downloads. Upon execution, the malware modifies critical Registry keys. Most commonly, it changes the `Shell` value in `HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon` from `explorer.exe` to the malware's executable (`T1547.004`). When the user logs in, the malware launches instead of the Windows desktop, displaying the lock screen. Advanced variants may also disable Task Manager, Safe Mode, and Command Prompt to prevent the user from bypassing the screen.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate loss of availability, but without data destruction. EDR platforms should alert on unauthorized modifications to the Winlogon registry keys. Because the system is locked, incident response often requires booting from a Live USB or utilizing a recovery environment to access the registry offline and repair the modified `Shell` value.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1491",
    "T1562.001",
    "T1489",
    "T1547.004",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491",
      "name": "Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1547.004",
      "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Do not pay the ransom; the files are not encrypted, and the 'police' warning is entirely fraudulent.",
    "Boot the infected machine into 'Safe Mode with Command Prompt' (if the malware has not disabled it) to bypass the graphical lock screen.",
    "Utilize a Live OS (like a Linux USB or Windows PE) to mount the hard drive offline, load the Windows Registry hive, and manually restore the `Winlogon\\Shell` key to `explorer.exe`.",
    "Once the Windows shell is restored, run a comprehensive antivirus scan to remove the underlying malware binaries."
  ],
  "what_to_avoid": [
    "Avoid assuming the data is lost; Lockscreen malware rarely encrypts files. Do not format the hard drive without attempting a registry repair first.",
    "Do not attempt to interact with the lock screen interface or click any links it provides."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}