d1871ae9ad5928623cbb92ee09f62c262d8c33c835b8c731eddc9243921a5318

General

Target
winlocker.exe
Size 9.0MB
Sample260529-raecnsc151
SHA256 d1871ae9ad5928623cbb92ee09f62c262d8c33c835b8c731eddc9243921a5318
MD5 497f657947e50d49a6fadd657bdcf82c
SHA1 d3f22b04f41bcfa527e0e2b7294a71961b85565a
SHA512 62dd9223c7c0176e238ff2a861d6259e0cfc9f64dcf777d0dd1f71970157d6b728582ad9c7abe3ef734956a8ec1279c3899923a9ec9a956c1391b80a6aed935f
SSDEEP 196608:tc50W8/LapphkDfyGg8wBdnpkYRM0/1E3+dgSUyMn:tVW8OpaDfDg8c6qE3+d9UyM
TLSH
T14A963354778808D8E8ABA37E98C0972762E2B8324796D6CB5BF44F001D237E4EFB5751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  winlocker.exe
- Size 9.0MB
- SHA256 d1871ae9ad5928623cbb92ee09f62c262d8c33c835b8c731eddc9243921a5318
- MD5 497f657947e50d49a6fadd657bdcf82c
- SHA1 d3f22b04f41bcfa527e0e2b7294a71961b85565a
- SHA512 62dd9223c7c0176e238ff2a861d6259e0cfc9f64dcf777d0dd1f71970157d6b728582ad9c7abe3ef734956a8ec1279c3899923a9ec9a956c1391b80a6aed935f
- SSDEEP 196608:tc50W8/LapphkDfyGg8wBdnpkYRM0/1E3+dgSUyMn:tVW8OpaDfDg8c6qE3+d9UyM
- TLSH
  T14A963354778808D8E8ABA37E98C0972762E2B8324796D6CB5BF44F001D237E4EFB5751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution persistence privilege_escalation pyinstaller trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- Turns off Windows Defender SpyNet reporting
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2