infinitylock | hxxps://www[.]youtube[.]com/watch?v=hpGxvmayq20 | Triage

Resubmissions

12-04-2024 09:38

240412-lmeajshc69 1

12-04-2024 09:17

240412-k82gjacc6t 10

Sharing

General

Target

https://www.youtube.com/watch?v=hpGxvmayq20
Sample

240412-k82gjacc6t

Score

10^/10

infinitylock bootkit evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  https://www.youtube.com/watch?v=hpGxvmayq20
Score

10^/10

infinitylock bootkit evasion persistence ransomware trojan
- InfinityLock Ransomware
  Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
  ransomware infinitylock
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Pre-OS Boot

Bootkit

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Abuse Elevation Control Mechanism

Bypass User Account Control

Scheduled Task/Job

Defense Evasion

Modify Registry

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

Tasks

static1

urlscan1

behavioral1

infinitylockbootkitevasionpersistenceransomwaretrojan