Overview

overview

10

Static

static

3

OsLock.exe

windows7-x64

10

OsLock.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OsLock.exe

  • Size

    385KB

  • Sample

    241122-k51qtsxrcz

  • MD5

    675ea787630f596da0474830ffb49723

  • SHA1

    c8e18cbc3cca1ded47eb5860a71b9f22d46409e1

  • SHA256

    ad861f41bb4a31ee778bf60cecf0a7bdd9c0cc91d5cc17775d15199c214fbccf

  • SHA512

    fa3c2c6edd3435bd16ec652c1738695cd1e8cdbd010b55fd856cefdbebd50552074d06e9b66860fae9c3a2f71ffe1076bb0227944b49286f05e1a3a4c871014d

  • SSDEEP

    6144:Z1IE/9oydPc4IvjTZlyZsDDyr3rAUp48zUCpM69/KImQi/6ebkY:Z1vlc4IrTZlyGDc54

Score
10/10
defense_evasionpersistence

Malware Config

Targets

    • Target

      OsLock.exe

    • Size

      385KB

    • MD5

      675ea787630f596da0474830ffb49723

    • SHA1

      c8e18cbc3cca1ded47eb5860a71b9f22d46409e1

    • SHA256

      ad861f41bb4a31ee778bf60cecf0a7bdd9c0cc91d5cc17775d15199c214fbccf

    • SHA512

      fa3c2c6edd3435bd16ec652c1738695cd1e8cdbd010b55fd856cefdbebd50552074d06e9b66860fae9c3a2f71ffe1076bb0227944b49286f05e1a3a4c871014d

    • SSDEEP

      6144:Z1IE/9oydPc4IvjTZlyZsDDyr3rAUp48zUCpM69/KImQi/6ebkY:Z1vlc4IrTZlyGDc54

    Score
    10/10
    defense_evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks