General
-
Target
WinLocker.exe
-
Size
2.5MB
-
Sample
240604-q9j7jaab85
-
MD5
9c75327333c7c8bf26fee3e7d3b34cd2
-
SHA1
ebcca4f4a538f4725c1d063d6f3af8f0f097d11a
-
SHA256
3cee8d85cbc8ade23c6a98f450108bbbf3ca30f41ef5286eb6ed7fa1127e04c9
-
SHA512
631cc9fb7149fa780bc2cb08f21b2054a8bf46a4650ee02e933bbf4be9ea54caa280b07fcdadaad5dc651bfe798c32b5968be907bd4a441cd7fa304047a6cc7e
-
SSDEEP
49152:7zf6V1jqp9ekTDQSxfHLqY+xKkmyLW5RhM0glV:7zyV0p5fOtIFIlV
Static task
static1
Behavioral task
behavioral1
Sample
WinLocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
WinLocker.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
WinLocker.exe
-
Size
2.5MB
-
MD5
9c75327333c7c8bf26fee3e7d3b34cd2
-
SHA1
ebcca4f4a538f4725c1d063d6f3af8f0f097d11a
-
SHA256
3cee8d85cbc8ade23c6a98f450108bbbf3ca30f41ef5286eb6ed7fa1127e04c9
-
SHA512
631cc9fb7149fa780bc2cb08f21b2054a8bf46a4650ee02e933bbf4be9ea54caa280b07fcdadaad5dc651bfe798c32b5968be907bd4a441cd7fa304047a6cc7e
-
SSDEEP
49152:7zf6V1jqp9ekTDQSxfHLqY+xKkmyLW5RhM0glV:7zyV0p5fOtIFIlV
Score10/10-
Sets file execution options in registry
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2