b372e5ae90e6851aa0f904046ae8ea99ee2a397cbdff3be79db64568770bb8fb

General

Target
lock.exe
Size 9.0MB
Sample260529-slznesev61
SHA256 b372e5ae90e6851aa0f904046ae8ea99ee2a397cbdff3be79db64568770bb8fb
MD5 0b4d1ca2e7e685b0d40860153380e319
SHA1 978dd598de15f08040ab08e11749572d46ed61f5
SHA512 0115557222ee7ebacc37933666225b8fa3302a6b5e50a95a915fac538b13b46e6ce405dc0abf9bc26c8edcc61ba30465e95152aa4d86caad3b06ed838b7dd38d
SSDEEP 196608:ah50W8/LapphUGsDfyGg8wBdnpkYRM0/1E3+dgSUy+g:a4W8OpYDfDg8c6qE3+d9Uy+
TLSH
T175963394739808E4E8ABA37D98C09327B2E2B8324796D6CB5FF44B501D236E4EF75351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  lock.exe
- Size 9.0MB
- SHA256 b372e5ae90e6851aa0f904046ae8ea99ee2a397cbdff3be79db64568770bb8fb
- MD5 0b4d1ca2e7e685b0d40860153380e319
- SHA1 978dd598de15f08040ab08e11749572d46ed61f5
- SHA512 0115557222ee7ebacc37933666225b8fa3302a6b5e50a95a915fac538b13b46e6ce405dc0abf9bc26c8edcc61ba30465e95152aa4d86caad3b06ed838b7dd38d
- SSDEEP 196608:ah50W8/LapphUGsDfyGg8wBdnpkYRM0/1E3+dgSUy+g:a4W8OpYDfDg8c6qE3+d9Uy+
- TLSH
  T175963394739808E4E8ABA37D98C09327B2E2B8324796D6CB5FF44B501D236E4EF75351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution persistence pyinstaller trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2