MITRE ATT&CKsoftware (malware)
S1178 ShrinkLocker
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2024-12-07
Description
ShrinkLocker is a VBS-based malicious script that leverages the legitimate Bitlocker application to encrypt files on victim systems for ransom. ShrinkLocker functions by using Bitlocker to encrypt files, then renames impacted drives to the adversary’s contact email address to facilitate communication for the ransom payment.
Related
Uses · MITRE ATT&CK (21)
- T1685 Disable or Modify Tools technique
- T1685.005 Clear Windows Event Logs sub-technique
- T1686 Disable or Modify System Firewall technique
- T1071.001 Web Protocols sub-technique
- T1059.001 PowerShell sub-technique
- T1059.005 Visual Basic sub-technique
- T1491.001 Internal Defacement sub-technique
- T1561.002 Disk Structure Wipe sub-technique
- T1070.004 File Deletion sub-technique
- T1529 System Shutdown/Reboot technique
- T1486 Data Encrypted for Impact technique
- T1485 Data Destruction technique
- T1480 Execution Guardrails technique
- T1016 System Network Configuration Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1047 Windows Management Instrumentation technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1102 Web Service technique
- T1112 Modify Registry technique
- T1124 System Time Discovery technique
References
- https://securelist.com/ransomware-abuses-bitlocker/112643/ Kaspersky ShrinkLocker 2024
- https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html Splunk ShrinkLocker 2024