cryptolocker | 362e2a76a5a851dde0dd6f29a07846343170a7a36cf5305e1b4cd4973278b60e | Triage

Sharing

General

Target

362e2a76a5a851dde0dd6f29a07846343170a7a36cf5305e1b4cd4973278b60e
Size

736KB
Sample

221019-s77wxsedc6
MD5

a09aac1c1901f88e3bc87430d028718d
SHA1

5a63efde486b7f6d8c78b606bd02a07769a7b3b3
SHA256

362e2a76a5a851dde0dd6f29a07846343170a7a36cf5305e1b4cd4973278b60e
SHA512

b1f11873196dbb49a55ad41fd54bc342e93b0185bff30bd03c6bd10dbad930a0cda30c69c34df03fecba34e08a2854675f8adb49c6ab58f05e6a769a16de315b
SSDEEP

12288:cFOCGlc1srI4hLyfoWA5o8nvwla94iQNES0GkoKf9L:cmWic40QWA+8vwW4iQN10H

Score

10^/10

cryptolocker persistence ransomware

Malware Config

Targets

- Target
  
  362e2a76a5a851dde0dd6f29a07846343170a7a36cf5305e1b4cd4973278b60e
- Size
  
  736KB
- MD5
  
  a09aac1c1901f88e3bc87430d028718d
- SHA1
  
  5a63efde486b7f6d8c78b606bd02a07769a7b3b3
- SHA256
  
  362e2a76a5a851dde0dd6f29a07846343170a7a36cf5305e1b4cd4973278b60e
- SHA512
  
  b1f11873196dbb49a55ad41fd54bc342e93b0185bff30bd03c6bd10dbad930a0cda30c69c34df03fecba34e08a2854675f8adb49c6ab58f05e6a769a16de315b
- SSDEEP
  
  12288:cFOCGlc1srI4hLyfoWA5o8nvwla94iQNES0GkoKf9L:cmWic40QWA+8vwW4iQN10H
Score

10^/10

cryptolocker persistence ransomware
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cryptolockerpersistenceransomware

behavioral2