{
  "family": "urausy",
  "sample_count": 1,
  "category": "ransomware",
  "description": "Ransom:Win32/Urausy (also known as a 'Police Trojan') represents a massive, historical wave of screen-locking ransomware. Unlike modern crypto-ransomware that encrypts files, Urausy locks the user's desktop interface entirely (`T1486`) and displays a localized, highly realistic warning purportedly from a local law enforcement agency (like the FBI, Interpol, or local police). The warning claims the user was caught viewing illegal content and must pay a 'fine' (usually via pre-paid cards like Ukash or Paysafecard) to unlock the machine.<br><br><b>Understanding Urausy (Screen-Locking Ransomware)</b><br>To an end-user, the computer is completely unusable; upon boot, they are immediately presented with a full-screen police warning that cannot be closed. For a SOC analyst, Urausy is a legacy threat that highlights the evolution of ransomware from psychological extortion (scareware) to actual cryptographic damage.<br><br><b>Execution and Extortion Mechanics</b><br>Urausy was primarily distributed via exploit kits (like Blackhole or Fiesta) (`T1189`) injected into compromised websites. Upon successful exploitation, the payload is dropped and executes. It achieves persistence by replacing the default Windows shell (typically `explorer.exe`) in the registry (`HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell`) with its own executable (`T1547.004`). It actively monitors for and terminates task manager processes (`taskmgr.exe`) to prevent the user from killing the locker (`T1562.001`). Crucially, Urausy uses geolocation (via the victim's IP address) to display a customized ransom note in the correct language, featuring the logos of local law enforcement.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total denial of access to the desktop environment, though the underlying files are *not* encrypted. Host-based IoCs include the modification of the Winlogon Shell registry key, the presence of the malicious executable in the `%AppData%` directory, and the inability to launch `taskmgr.exe`. Network IoCs involve initial connections to known exploit kit landing pages.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1547.004",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (Used here as a generic mapping for Ransomware, though Urausy primarily locks the screen rather than encrypting)",
      "tactic": "Impact"
    },
    {
      "id": "T1547.004",
      "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL (Hijacking the shell to lock the screen upon boot)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Terminating Task Manager)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Boot the infected machine into Safe Mode with Command Prompt; this often bypasses the Winlogon Shell hijack.",
    "From the command prompt, launch `regedit.exe` and restore the `HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell` key back to `explorer.exe`.",
    "Locate and delete the malicious Urausy executable (often located in `%AppData%` or `%Temp%`).",
    "After rebooting normally, run a full AV scan to remove any secondary droppers that arrived with the exploit kit."
  ],
  "what_to_avoid": [
    "Do not format the drive or restore from backup immediately; unlike crypto-ransomware, Urausy infections can usually be removed without any data loss.",
    "Avoid paying the 'fine'; it goes directly to cybercriminals, not law enforcement."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}