General
- Target c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.bin
- Size 5.2MB
- Sample251110-s931razrdr
- SHA256 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c
Malware Config
Targets
-
- Target c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.bin
- Size 5.2MB
- SHA256 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c
Score10/10-
FunkLocker
FunkLocker is a ransomware attributed to FunkSec group.
-
Funklocker family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Disables Windows Security event logs
Uses wevtutil to disable the Windows Security event logs, preventing new Security events from being recorded and reducing audit trail visibility.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Disables Windows Application event log
Uses wevtutil to disable the Windows Application event log, preventing new Application events from being recorded and interfering with incident detection and investigation.
-
Stops running service(s)
-
Temporarily bypasses Powershell execution policy
Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
3System Services
1Service Execution
1Windows Management Instrumentation
1