General
- Target https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/UIWIX.exe
- Sample260731-trkl5awclc
Score
10/10
Malware Config
Targets
-
- Target https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/UIWIX.exe
Score10/10-
Detects HiddenTear Ransomware
-
Family: HiddenTear, Cryptear
HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Modifies WinLogon
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1