General
- Target WinLock.exe
- Size 23KB
- Sample260603-n3khlsfv2j
- SHA256 197fbb6f6276eaf6c5dd3ab01abf94a9817cfbbb3bbac9cb0e2906c449b01b29
Score
10/10
Malware Config
Targets
-
- Target WinLock.exe
- Size 23KB
- SHA256 197fbb6f6276eaf6c5dd3ab01abf94a9817cfbbb3bbac9cb0e2906c449b01b29
Score10/10Modifies WinLogon for persistence
UAC bypass
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Modifies boot configuration data using bcdedit
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
Disables RegEdit via registry modification
Disables Task Manager via registry modification
Executes dropped EXE
Impair Defenses: Safe Mode Boot
Adds Run key to start application
Checks whether UAC is enabled
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1