Overview

overview

10

Static

static

10

wlnlogon.exe

windows7_x64

9

wlnlogon.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    wlnlogon.exe

  • Size

    34KB

  • Sample

    210329-7afah9gsfe

  • MD5

    c626eb5448aafaeab9a3a207cca1f44c

  • SHA1

    b2197768b2f44c97e45a82ae9bfbbbb2a89c7cfa

  • SHA256

    4939669c7aa568cd8e714bb26b512cecb7e6477fef8053e3fcfdf81741033593

  • SHA512

    455c947fb9fe7dffc79a31e54d781b863bdb47acbf9ad7b4ab619177388a6bf7a01237cad945a88ee9e3121d74c01e74c851d3da89b4d3de5de4efb4389847e6

Score
10/10
makoppersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      wlnlogon.exe

    • Size

      34KB

    • MD5

      c626eb5448aafaeab9a3a207cca1f44c

    • SHA1

      b2197768b2f44c97e45a82ae9bfbbbb2a89c7cfa

    • SHA256

      4939669c7aa568cd8e714bb26b512cecb7e6477fef8053e3fcfdf81741033593

    • SHA512

      455c947fb9fe7dffc79a31e54d781b863bdb47acbf9ad7b4ab619177388a6bf7a01237cad945a88ee9e3121d74c01e74c851d3da89b4d3de5de4efb4389847e6

    Score
    10/10
    ransomwarespywarestealerpersistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Modifies Installed Components in the registry

      persistence

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks