Analysis
-
max time kernel
299s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 00:15
General
-
Target
wlock2.exe
-
Size
229KB
-
MD5
6e7d32b6a66ba7d6b6dbfe0adc5a7eff
-
SHA1
394b5f38d3a5a1ce2d3d0f3b046898f1a5519543
-
SHA256
e4e452529a55436c7608482ef47687ef48ece4b068a989ae5f86ef6c59ff49fc
-
SHA512
648b4f95b02b7e2e5e0aba3439066ab766ff6c01e9fc2d3b05d44b4a8862d7c8a88d27a8572d7fe5e3a8471bb217cf9c7179bd7ab8bacfd4a3d42dcf1f4699c2
-
SSDEEP
6144:6NjkWhUh1S4A05cYNe/8xXWwK80i6F+eco+Sxaat:8jkS50G5cXg66F+eeSQ
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\wlock2.exe"C:\Users\Admin\AppData\Local\Temp\wlock2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
264KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB