General
-
Target
WinLocker.exe.exe
-
Size
1.7MB
-
Sample
240615-z5bh9sydnj
-
MD5
1a013642c60039f6216d7f3906cacd00
-
SHA1
f43ed075850c4fb8e11e9c22ba05f3a8fe30cd7f
-
SHA256
4b168048b2b5ab19a73de1c6a3a970db65a3867f255f594be5373bfd7d1a5d93
-
SHA512
d9d2a3d46fec945400f7eec1f8f08632868829afaf417b3ad3e78e1ebb1e2601d9d68f96b75110fc0c788546da34d9e3bcb845d351796db99b96a8f51fb461ca
-
SSDEEP
49152:1gWzFQAwEI2iMaPhsnplri54blFp8SM6JYPTqs72cz2:mWOAfIiae2mblFpdjYPD72P
Behavioral task
behavioral1
Sample
WinLocker.exe
Resource
win11-20240508-en
Malware Config
Targets
-
-
Target
WinLocker.exe.exe
-
Size
1.7MB
-
MD5
1a013642c60039f6216d7f3906cacd00
-
SHA1
f43ed075850c4fb8e11e9c22ba05f3a8fe30cd7f
-
SHA256
4b168048b2b5ab19a73de1c6a3a970db65a3867f255f594be5373bfd7d1a5d93
-
SHA512
d9d2a3d46fec945400f7eec1f8f08632868829afaf417b3ad3e78e1ebb1e2601d9d68f96b75110fc0c788546da34d9e3bcb845d351796db99b96a8f51fb461ca
-
SSDEEP
49152:1gWzFQAwEI2iMaPhsnplri54blFp8SM6JYPTqs72cz2:mWOAfIiae2mblFpdjYPD72P
Score10/10-
Sets file execution options in registry
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2