cryptolocker | 25f32a5b479f153bb5e009d97b1c67975ace08fc0a55c7672365d32296d9d6e1

General

Target

2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe
Size

390KB
MD5

1715bfa5f8e214c5ac3f2cab2126785f
SHA1

0271c2fff5f9d0a509092727fae5eed0fc96faf5
SHA256

25f32a5b479f153bb5e009d97b1c67975ace08fc0a55c7672365d32296d9d6e1
SHA512

499f3c90288ed2a1aef9cafcf3047fceffdfdf878cf4f26fb0a0c8a25d7c7f53513b5e38c6b311eff9d8280a2df413d756f35665e12c2e8576da3ad801e4c351
SSDEEP

6144:HWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvCwd8IQ3:HWkEuCaNT85I2vCMX5l+ZRvZdfQ3

Score

10^/10

cryptolocker persistence ransomware

Malware Config

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Deletes itself 1 IoCs

Processes:

{34184A33-0407-212E-3320-09040709E2C2}.exe

pid process

2308 {34184A33-0407-212E-3320-09040709E2C2}.exe
Executes dropped EXE 2 IoCs

Processes:

{34184A33-0407-212E-3320-09040709E2C2}.exe{34184A33-0407-212E-3320-09040709E2C2}.exe

pid process

2308 {34184A33-0407-212E-3320-09040709E2C2}.exe
2824 {34184A33-0407-212E-3320-09040709E2C2}.exe
Loads dropped DLL 2 IoCs

Processes:

2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe{34184A33-0407-212E-3320-09040709E2C2}.exe

pid process

1412 2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe
2308 {34184A33-0407-212E-3320-09040709E2C2}.exe

pid	process
2308	{34184A33-0407-212E-3320-09040709E2C2}.exe

pid	process
2308	{34184A33-0407-212E-3320-09040709E2C2}.exe
2824	{34184A33-0407-212E-3320-09040709E2C2}.exe

pid	process
1412	2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe
2308	{34184A33-0407-212E-3320-09040709E2C2}.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

{34184A33-0407-212E-3320-09040709E2C2}.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe{34184A33-0407-212E-3320-09040709E2C2}.exe

description	pid	process	target process
PID 1412 wrote to memory of 2308	1412	2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe	{34184A33-0407-212E-3320-09040709E2C2}.exe
PID 1412 wrote to memory of 2308	1412	2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe	{34184A33-0407-212E-3320-09040709E2C2}.exe
PID 1412 wrote to memory of 2308	1412	2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe	{34184A33-0407-212E-3320-09040709E2C2}.exe
PID 1412 wrote to memory of 2308	1412	2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe	{34184A33-0407-212E-3320-09040709E2C2}.exe
PID 2308 wrote to memory of 2824	2308	{34184A33-0407-212E-3320-09040709E2C2}.exe	{34184A33-0407-212E-3320-09040709E2C2}.exe
PID 2308 wrote to memory of 2824	2308	{34184A33-0407-212E-3320-09040709E2C2}.exe	{34184A33-0407-212E-3320-09040709E2C2}.exe
PID 2308 wrote to memory of 2824	2308	{34184A33-0407-212E-3320-09040709E2C2}.exe	{34184A33-0407-212E-3320-09040709E2C2}.exe
PID 2308 wrote to memory of 2824	2308	{34184A33-0407-212E-3320-09040709E2C2}.exe	{34184A33-0407-212E-3320-09040709E2C2}.exe

C:\Users\Admin\AppData\Local\Temp\2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
  "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\AppData\Local\Temp\2024-03-02_1715bfa5f8e214c5ac3f2cab2126785f_cryptolocker.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000000C8
    3⤵
    - Executes dropped EXE
    PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe

Filesize
128KB

MD5
aee88654a316eff7d678cb99f07d240e

SHA1
d3632283d4359ba7bff930e5155151b008767b49

SHA256
b70cdcbebb6516696866335ceab0a3bd7828d3ab5b1594021e8f92eb810a3e49

SHA512
742006064a276e9c23329d03ff7dfaced5140995196eae31b8129c6e5fe59fc97355f84ff0357eee9bdca7bc8cb89400ac62c982968ad9553450cbe42ed31c53

Download Submit
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe

Filesize
290KB

MD5
32423355e5af5edb759314c0539c3b87

SHA1
c22435b43de755d59793b20be2d710a9fd9cfb7d

SHA256
09c4f9853b18aaa8deb4527c58fa06482f8e3d5d70ea36da44bfc6b83e5fd0d3

SHA512
237bb5df2ff4695a62b8c9a699d41236a041eb3cbe24243edd271af1e28fc85e54bf17a190601e80c2f78226454ad8d175bdc6415b8bd633b9491626012eb328

Download Submit
\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe

Filesize
390KB

MD5
1715bfa5f8e214c5ac3f2cab2126785f

SHA1
0271c2fff5f9d0a509092727fae5eed0fc96faf5

SHA256
25f32a5b479f153bb5e009d97b1c67975ace08fc0a55c7672365d32296d9d6e1

SHA512
499f3c90288ed2a1aef9cafcf3047fceffdfdf878cf4f26fb0a0c8a25d7c7f53513b5e38c6b311eff9d8280a2df413d756f35665e12c2e8576da3ad801e4c351

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads