cryptolocker | 2b9c435e6c5e7a4fc2ef5a7dce9f9bc928cef5325eda8799810beb91b2287662 | Triage

Sharing

General

Target

2b9c435e6c5e7a4fc2ef5a7dce9f9bc928cef5325eda8799810beb91b2287662
Size

544KB
Sample

221003-237vssbeb3
MD5

6136e79fbbe4cfbadcace9fa3d015170
SHA1

3ff9da637427740e373f032c99cf6e29ad27e37a
SHA256

2b9c435e6c5e7a4fc2ef5a7dce9f9bc928cef5325eda8799810beb91b2287662
SHA512

57fc2e764acb17b5b145f51e5b1fc22a79a028750c155ab8de8ffddfd65e97e7cf61f5984fffe182c9cfef6f0e97b6e25e570910e76609c8741735a0f17a6ddd
SSDEEP

12288:GAp4xkuItDWc2jR8bn1gdUMDhRGm7sHpeSVyPK8rnSnznL84W7DprS:GA7ZKHRen1g/R17sHpXyPKsSnznLXoU

Score

10^/10

cryptolocker persistence ransomware

Malware Config

Targets

- Target
  
  2b9c435e6c5e7a4fc2ef5a7dce9f9bc928cef5325eda8799810beb91b2287662
- Size
  
  544KB
- MD5
  
  6136e79fbbe4cfbadcace9fa3d015170
- SHA1
  
  3ff9da637427740e373f032c99cf6e29ad27e37a
- SHA256
  
  2b9c435e6c5e7a4fc2ef5a7dce9f9bc928cef5325eda8799810beb91b2287662
- SHA512
  
  57fc2e764acb17b5b145f51e5b1fc22a79a028750c155ab8de8ffddfd65e97e7cf61f5984fffe182c9cfef6f0e97b6e25e570910e76609c8741735a0f17a6ddd
- SSDEEP
  
  12288:GAp4xkuItDWc2jR8bn1gdUMDhRGm7sHpeSVyPK8rnSnznL84W7DprS:GA7ZKHRen1g/R17sHpXyPKsSnznLXoU
Score

10^/10

cryptolocker persistence ransomware
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cryptolockerpersistenceransomware

behavioral2