General
- Target 2026-06-03_6c2799f0aceed0f2b29340fb1a2e6b72_elex_lockbit
- Size 39KB
- Sample260603-qjdl3agx9j
- SHA256 fb34bfa5087d00724cbbd6af30e244dd8d732f70df3c4625b08a625a5e92cf13
Score
10/10
Malware Config
Targets
-
- Target 2026-06-03_6c2799f0aceed0f2b29340fb1a2e6b72_elex_lockbit
- Size 39KB
- SHA256 fb34bfa5087d00724cbbd6af30e244dd8d732f70df3c4625b08a625a5e92cf13
Score10/10Modifies Windows Defender notification settings
Windows security bypass
Disables taskbar notifications via registry modification
Modifies RDP port number used by Windows
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Modifies visibility of existing users in the login screen
A user account was hidden or made visible on the Windows login screen through a registry modification.
Windows security modification
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Modifies WinLogon
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Users
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5