General
- Target WinLock.exe
- Size 25KB
- Sample260603-pm2bvsf19n
- SHA256 45a46b9d1051148d2d8b41de49ad881a0861f9151fcc8fd88b616931e1436c43
Score
10/10
Malware Config
Targets
-
- Target WinLock.exe
- Size 25KB
- SHA256 45a46b9d1051148d2d8b41de49ad881a0861f9151fcc8fd88b616931e1436c43
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1