b96d86d4006dd7f90816cfbc53105c06dfc22b7390137e15d45c8deca3ca3c5d

General

Target
winlocker.exe
Size 16.2MB
Sample261017-l2tzjsxt8j
SHA256 b96d86d4006dd7f90816cfbc53105c06dfc22b7390137e15d45c8deca3ca3c5d
MD5 2b259fbe5fdbc85fa09ba840f7aee64d
SHA1 799768830a0199def75cd5b28690e5dc339c5b78
SHA512 5afffa7aa165c9689a7f11797f6a95423f8d33b68d70462c63e98a273fa14749a1dc3c0c98955eba45e80e525771e8f39b43d6441af6871b127f2566655a09bf
SSDEEP 49152:1xn9du9BJAiiWGgt9IPXY32Z0PYriUTkqyDaDXVLh5PAzuKTW/UMXkRRJzS6i0sv:1x9
TLSH
T11A073038B9D518BE7B6759EE87F63A9D5909F3BBB3065D7C20B2314A43039098CE4724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  winlocker.exe
- Size 16.2MB
- SHA256 b96d86d4006dd7f90816cfbc53105c06dfc22b7390137e15d45c8deca3ca3c5d
- MD5 2b259fbe5fdbc85fa09ba840f7aee64d
- SHA1 799768830a0199def75cd5b28690e5dc339c5b78
- SHA512 5afffa7aa165c9689a7f11797f6a95423f8d33b68d70462c63e98a273fa14749a1dc3c0c98955eba45e80e525771e8f39b43d6441af6871b127f2566655a09bf
- SSDEEP 49152:1xn9du9BJAiiWGgt9IPXY32Z0PYriUTkqyDaDXVLh5PAzuKTW/UMXkRRJzS6i0sv:1x9
- TLSH
  T11A073038B9D518BE7B6759EE87F63A9D5909F3BBB3065D7C20B2314A43039098CE4724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery evasion execution persistence ransomware spyware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Checks whether UAC is enabled
  defense_evasion trojan
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1