cryptolocker | bfd5b5dbaab84dbdc50baef0a72d53681284c2d919ee473c99e3b6c745d325b8 | Triage

Sharing

General

Target

d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9.zip
Size

282KB
Sample

240417-xxvk3acf8t
MD5

0110a3b156c4ba9eccdb63d095164a74
SHA1

988e873fd737d8b0096f6c858157c437b664fe27
SHA256

bfd5b5dbaab84dbdc50baef0a72d53681284c2d919ee473c99e3b6c745d325b8
SHA512

781178e20be42771a650459bf38c94343270a97a59e348084d41ef49f0ea9def1ef39fb8867b4e02e9adbf5bdad395a8718ac038506ab8498e8045ca55e6b02c
SSDEEP

6144:HcUal4OmhXznabhbP5R7jpicZKnfdImmb6AzU7Q3fE1v:8U+4OmhDnytP5NjX4nfwb6j7ofEF

Score

10^/10

cryptolocker persistence ransomware

Malware Config

Targets

- Target
  
  d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9.exe
- Size
  
  338KB
- MD5
  
  04fb36199787f2e3e2135611a38321eb
- SHA1
  
  65559245709fe98052eb284577f1fd61c01ad20d
- SHA256
  
  d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
- SHA512
  
  533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
- SSDEEP
  
  6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
Score

10^/10

cryptolocker persistence ransomware
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cryptolockerpersistenceransomware