infinitylock | hxxps://www[.]youtube[.]com/watch?v=hpGxvmayq20 | Triage

Resubmissions

12-04-2024 09:38

240412-lmeajshc69 1

12-04-2024 09:17

240412-k82gjacc6t 10

Sharing

General

Target

https://www.youtube.com/watch?v=hpGxvmayq20
Sample

240412-k82gjacc6t

Score

10^/10

infinitylock bootkit evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  https://www.youtube.com/watch?v=hpGxvmayq20
Score

10^/10

infinitylock bootkit evasion persistence ransomware trojan
- InfinityLock Ransomware
  Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
  ransomware infinitylock
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Pre-OS Boot

Bootkit

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

urlscan1

behavioral1

infinitylockbootkitevasionpersistenceransomwaretrojan