infinitylock | ac187704d5311c8b80a775916ac1629351b24619f874147141ce43cef6076d34 | Triage

Sharing

General

Target

classcharts code.txt
Size

10B
Sample

241023-qzhkysvekp
MD5

66dadbcd057e6c27424e9d7ebdf7b5f0
SHA1

96c0b1cbb828a55f78599d321037d8ed63c29189
SHA256

ac187704d5311c8b80a775916ac1629351b24619f874147141ce43cef6076d34
SHA512

50ec68b1040dfef35ed0f93f9e0fbebbe790d7bc856bc249f94a3223abfd20b3507d0719dc8fe51292992606731d5f5149ad749b2566ce0da6f8232a150aafff

Score

10^/10

infinitylock discovery evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  classcharts code.txt
- Size
  
  10B
- MD5
  
  66dadbcd057e6c27424e9d7ebdf7b5f0
- SHA1
  
  96c0b1cbb828a55f78599d321037d8ed63c29189
- SHA256
  
  ac187704d5311c8b80a775916ac1629351b24619f874147141ce43cef6076d34
- SHA512
  
  50ec68b1040dfef35ed0f93f9e0fbebbe790d7bc856bc249f94a3223abfd20b3507d0719dc8fe51292992606731d5f5149ad749b2566ce0da6f8232a150aafff
Score

10^/10

infinitylock discovery evasion persistence ransomware trojan
- InfinityLock Ransomware
  Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
  ransomware infinitylock
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

infinitylockdiscoveryevasionpersistenceransomwaretrojan