How ransomware abuses BitLocker
Tags
Common Information
| Type | Value |
|---|---|
| UUID | a3a738c4-78b6-4b5d-be7f-56b253b5d74a |
| Fingerprint | bc96286f6d60abc7 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | May 23, 2024, noon |
| Added to db | Oct. 1, 2024, 3:43 p.m. |
| Last updated | Nov. 17, 2024, 6:56 p.m. |
| Headline | ShrinkLocker: Turning BitLocker into ransomware |
| Title | How ransomware abuses BitLocker |
| Detected Hints/Tags/Attributes | 82/3/44 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://securelist.com/ransomware-abuses-bitlocker/112643/ |
| Details | Redirection | https://securelist.com/ransomware-abuses-bitlocker/112643 |
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 74 | adodb.stream |
|
| Details | Domain | 372 | wscript.shell |
|
| Details | Domain | 15 | trycloudflare.com |
|
| Details | Domain | 338 | kaspersky.com |
|
| Details | 2 | gert@kaspersky.com |
||
| Details | File | 229 | advapi32.dll |
|
| Details | File | 1 | c:\programdata\microsoft\windows\templates\ as disk.vbs |
|
| Details | File | 1208 | powershell.exe |
|
| Details | File | 1 | protector.key |
|
| Details | File | 1 | httprequest.opt |
|
| Details | File | 13 | scheduledtasks.xml |
|
| Details | File | 2 | login.vbs |
|
| Details | File | 2 | disk.vbs |
|
| Details | File | 1 | c:\programdata\microsoft\windows\templates\disk.vbs |
|
| Details | File | 20 | trojan.vbs |
|
| Details | File | 1 | trojan-ransom.vbs |
|
| Details | md5 | 1 | 842f7b1c425c5cf41aed9df63888e768 |
|
| Details | MITRE ATT&CK Techniques | 137 | T1059.005 |
|
| Details | MITRE ATT&CK Techniques | 310 | T1047 |
|
| Details | MITRE ATT&CK Techniques | 460 | T1059.001 |
|
| Details | MITRE ATT&CK Techniques | 472 | T1486 |
|
| Details | MITRE ATT&CK Techniques | 48 | T1529 |
|
| Details | MITRE ATT&CK Techniques | 92 | T1070.001 |
|
| Details | MITRE ATT&CK Techniques | 550 | T1112 |
|
| Details | MITRE ATT&CK Techniques | 70 | T1562.004 |
|
| Details | MITRE ATT&CK Techniques | 422 | T1041 |
|
| Details | Url | 1 | https://generated-eating-meals-top[dot]trycloudflare.com/updatelog |
|
| Details | Url | 1 | https://generated-eating-meals-top[dot]trycloudflare.com/updatelogead |
|
| Details | Url | 1 | https://earthquake-js-westminster-searched[dot]trycloudflare.com:443/updatelog |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\Policies\Microsoft\FVE\UseTPMPIN |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\Policies\Microsoft\FVE\UseTPMKey |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\Policies\Microsoft\FVE\UseTPMKeyPIN |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\Policies\Microsoft\FVE\EnableNonTPM |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\Policies\Microsoft\FVE\UsePartialEncryptionKey |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\Policies\Microsoft\FVE\UsePIN |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE\UseAdvancedStartup |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE\EnableBDEWithNoTPM |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE\UseTPM |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE\UseTPMPIN |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE\UseTPMKey |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE\UseTPMKeyPIN |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE\EnableNonTPM |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE\UsePartialEncryptionKey |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE\UsePIN |