cryptolocker | 7fac039c61c137a2e71a9224a2fcb729d25cd5aa8c3b135f1aaa7cb69044e18e | Triage

Sharing

General

Target

7fac039c61c137a2e71a9224a2fcb729d25cd5aa8c3b135f1aaa7cb69044e18e
Size

1009KB
Sample

221014-d6q5fsefhn
MD5

60a5f960e38af6942569af03492e4086
SHA1

e1a8ad4a82f2fceadb9d1fd46168030f8047c092
SHA256

7fac039c61c137a2e71a9224a2fcb729d25cd5aa8c3b135f1aaa7cb69044e18e
SHA512

641172cf4bec42cfcf78512fa68bfb731045ff70049f7212af412ed91881416256c3fb390cb85c744ce437580758424dfbfde4db62cbcdfd0a103c917247352a
SSDEEP

12288:0BAlraFSO2vpEnhqg9GuF+lrnBRMQdod5rL+/yfY3C2ww6WGpVaL7VZ:0iFRahqgS9FyfYTr6XpVaLb

Score

10^/10

cryptolocker persistence ransomware

Malware Config

Targets

- Target
  
  7fac039c61c137a2e71a9224a2fcb729d25cd5aa8c3b135f1aaa7cb69044e18e
- Size
  
  1009KB
- MD5
  
  60a5f960e38af6942569af03492e4086
- SHA1
  
  e1a8ad4a82f2fceadb9d1fd46168030f8047c092
- SHA256
  
  7fac039c61c137a2e71a9224a2fcb729d25cd5aa8c3b135f1aaa7cb69044e18e
- SHA512
  
  641172cf4bec42cfcf78512fa68bfb731045ff70049f7212af412ed91881416256c3fb390cb85c744ce437580758424dfbfde4db62cbcdfd0a103c917247352a
- SSDEEP
  
  12288:0BAlraFSO2vpEnhqg9GuF+lrnBRMQdod5rL+/yfY3C2ww6WGpVaL7VZ:0iFRahqgS9FyfYTr6XpVaLb
Score

10^/10

cryptolocker persistence ransomware
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cryptolockerpersistenceransomware

behavioral2