Overview

overview

10

Static

static

3

CryptoLock...3).exe

windows7-x64

10

CryptoLock...3).exe

windows10-2004-x64

3

Resubmissions

12-05-2024 21:47

240512-1m9tsagc3s 3

12-05-2024 04:00

240512-ekmqksaf77 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3824d49d77fbf3acc9afd621a63c302e_JaffaCakes118

  • Size

    579KB

  • Sample

    240512-ekmqksaf77

  • MD5

    3824d49d77fbf3acc9afd621a63c302e

  • SHA1

    1f87dd119d1f6f91a88e5890fb4ca11da0f4f4f9

  • SHA256

    f1ed39e3adcf0f0b1fdde99601fd83a62ee13002a279ec5d2ebafafc51ab348f

  • SHA512

    e5d66a8fc788467e8190f9bf5995c8046e3696910f5ffe8f3d8ac0edef7b250c6cf8141c846f8ee03c555205786d1fd22b0664bdc7e75ae6c6e61ce281f06000

  • SSDEEP

    12288:/1zdBrPvGkOUexRDLVYdehWWtVx5jMGMiRAzeU4/KkCCJdasoNxR:/HBrvGk4xDYdStVxYzzelV3oB

Score
10/10
cryptolockerpersistenceransomware

Malware Config

Targets

    • Target

      CryptoLocker (2013).exe

    • Size

      827KB

    • MD5

      7f9c454a2e016e533e181d53eba113bc

    • SHA1

      694dc7713537a7237030f7623881423fcb8d8c5c

    • SHA256

      c7dc529d8aae76b4e797e4e9e3ea7cd69669e6c3bb3f94d80f1974d1b9f69378

    • SHA512

      6869cf5a7c3526acf402b1ef09a9477dedf6cf534ff728e0823b9413ba41e888bd5b61cc20421d4a799df493126598a4a906ac2ab46147d9e4bcfa5d3600a110

    • SSDEEP

      12288:06NINoPgXqvRyq5E3R18y0kQzX3EL1TdB0JUsoSfsJuRqQy5d5t:06iWP9JAR18ycD3ErB2rs8MQy5

    Score
    10/10
    cryptolockerpersistenceransomware

    • CryptoLocker

      Ransomware family with multiple variants.

      ransomwarecryptolocker

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks