Overview

overview

10

Static

static

1

image.png

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    image.png

  • Size

    7KB

  • Sample

    240702-raxh9avhkf

  • MD5

    8a5d9ed2e28fbd931a184e41c1bfc448

  • SHA1

    656d42a076e16b272e98b0fdef7cfc97ab5ac007

  • SHA256

    92d59f918083649917c9e4d5cc01ac75f7527dd55e5adbb4dcea3f72e5d11daa

  • SHA512

    1bc48370209ddca6aa3ee4e2308a9a8d7e6943b0d206d8b18504c5e5c68e450668b6fc835f2594eec883c7413375209f38446856e4e9eb588ebd7ee8aaa50a97

  • SSDEEP

    192:SzG/fIsAVahNR5rwQK+wetFt1Lzi5+CnxQ032zD:SzgEaffNc+1L4vxQ0YD

Score
10/10
cryptolockerbootkitevasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      image.png

    • Size

      7KB

    • MD5

      8a5d9ed2e28fbd931a184e41c1bfc448

    • SHA1

      656d42a076e16b272e98b0fdef7cfc97ab5ac007

    • SHA256

      92d59f918083649917c9e4d5cc01ac75f7527dd55e5adbb4dcea3f72e5d11daa

    • SHA512

      1bc48370209ddca6aa3ee4e2308a9a8d7e6943b0d206d8b18504c5e5c68e450668b6fc835f2594eec883c7413375209f38446856e4e9eb588ebd7ee8aaa50a97

    • SSDEEP

      192:SzG/fIsAVahNR5rwQK+wetFt1Lzi5+CnxQ032zD:SzgEaffNc+1L4vxQ0YD

    Score
    10/10
    cryptolockerbootkitevasionpersistenceransomwaretrojan

    • CryptoLocker

      Ransomware family with multiple variants.

      ransomwarecryptolocker

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks