General
- Target c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.bin
- Size 5.2MB
- Sample251010-d9vbaayqt3
- SHA256 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c
Malware Config
Targets
-
- Target c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.bin
- Size 5.2MB
- SHA256 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c
Score10/10FunkLocker
FunkLocker is a ransomware attributed to FunkSec group.
Funklocker family
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Disables Windows Security event logs
Uses wevtutil to disable the Windows Security event logs, preventing new Security events from being recorded and reducing audit trail visibility.
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
Disables Windows Application event log
Uses wevtutil to disable the Windows Application event log, preventing new Application events from being recorded and interfering with incident detection and investigation.
Stops running service(s)
Temporarily bypasses Powershell execution policy
Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
3System Services
1Service Execution
1Windows Management Instrumentation
1