cb768759a4205a4a4307ceeedd3cb44aa9a21894d50a96cd105ac557002ec7f1

General

Target
WinLocker.exe
Size 31KB
Sample260704-rnb5gaf141
SHA256 cb768759a4205a4a4307ceeedd3cb44aa9a21894d50a96cd105ac557002ec7f1
MD5 e4e969729b19c0c07ff48bf370a431ce
SHA1 464064f941ac6660d85187e04348ed66037e9be3
SHA512 4263018d0df9a7e57f8b8eaa5d7d0e229cab09e76d60db852f2d061bb6221c2a7c80825b715461f4c8b5fda595c6307b2d095ef02a84877faadb72ef8e183ffb
SSDEEP 384:0JQSZbHQNI9sfNS6PPXLCVYKiWbyI2yM1nVcNGN7CACBHxJb/X4f8:DSZncNPLCeWbM1nC4OACJoU
TLSH
T133E2D640F7F8440AF7FE5EB99CB115441A77BCA21D22DF8D0C98508D09B7B90EA61B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  WinLocker.exe
- Size 31KB
- SHA256 cb768759a4205a4a4307ceeedd3cb44aa9a21894d50a96cd105ac557002ec7f1
- MD5 e4e969729b19c0c07ff48bf370a431ce
- SHA1 464064f941ac6660d85187e04348ed66037e9be3
- SHA512 4263018d0df9a7e57f8b8eaa5d7d0e229cab09e76d60db852f2d061bb6221c2a7c80825b715461f4c8b5fda595c6307b2d095ef02a84877faadb72ef8e183ffb
- SSDEEP 384:0JQSZbHQNI9sfNS6PPXLCVYKiWbyI2yM1nVcNGN7CACBHxJb/X4f8:DSZncNPLCeWbM1nC4OACJoU
- TLSH
  T133E2D640F7F8440AF7FE5EB99CB115441A77BCA21D22DF8D0C98508D09B7B90EA61B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2