General

  • Target

    WinLocker.exe.exe

  • Size

    1.7MB

  • Sample

    240615-z5bh9sydnj

  • MD5

    1a013642c60039f6216d7f3906cacd00

  • SHA1

    f43ed075850c4fb8e11e9c22ba05f3a8fe30cd7f

  • SHA256

    4b168048b2b5ab19a73de1c6a3a970db65a3867f255f594be5373bfd7d1a5d93

  • SHA512

    d9d2a3d46fec945400f7eec1f8f08632868829afaf417b3ad3e78e1ebb1e2601d9d68f96b75110fc0c788546da34d9e3bcb845d351796db99b96a8f51fb461ca

  • SSDEEP

    49152:1gWzFQAwEI2iMaPhsnplri54blFp8SM6JYPTqs72cz2:mWOAfIiae2mblFpdjYPD72P

Malware Config

Targets

    • Target

      WinLocker.exe.exe

    • Size

      1.7MB

    • MD5

      1a013642c60039f6216d7f3906cacd00

    • SHA1

      f43ed075850c4fb8e11e9c22ba05f3a8fe30cd7f

    • SHA256

      4b168048b2b5ab19a73de1c6a3a970db65a3867f255f594be5373bfd7d1a5d93

    • SHA512

      d9d2a3d46fec945400f7eec1f8f08632868829afaf417b3ad3e78e1ebb1e2601d9d68f96b75110fc0c788546da34d9e3bcb845d351796db99b96a8f51fb461ca

    • SSDEEP

      49152:1gWzFQAwEI2iMaPhsnplri54blFp8SM6JYPTqs72cz2:mWOAfIiae2mblFpdjYPD72P

    • UAC bypass

    • Sets file execution options in registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Discovery

System Information Discovery

2
T1082

Tasks