cryptolocker

General

Target

Drawful 2.exe
Size

11.2MB
Sample

240818-qymtaawbnd
MD5

deb86bf934ad91d4adc08b9e94bf4a84
SHA1

0f1742dd0528a6f7b6d7717b6b3117ea94486d61
SHA256

0b05e398a1cb8511549b2d76f7e68f8b869395d52c8a05242c2f6da32d4b5b70
SHA512

5e9ed7736c8acbdf575ff69f7f7844c2de66ea648445a9a4a5a6c55883b08472cbae4320e10f3dd7eddee1f16a23532a4e6cecdbca3f78cb1ea5e6a94cd0fe6c
SSDEEP

196608:gpJwe+BtisZuuJZ8CxsL2tThLzdTB1AdDtH0C9SOSAC/:ewYsZuu38CSSlPLOH/gOSAC/

Score

10^/10

Malware Config

Targets

- Target
  
  Drawful 2.exe
- Size
  
  11.2MB
- MD5
  
  deb86bf934ad91d4adc08b9e94bf4a84
- SHA1
  
  0f1742dd0528a6f7b6d7717b6b3117ea94486d61
- SHA256
  
  0b05e398a1cb8511549b2d76f7e68f8b869395d52c8a05242c2f6da32d4b5b70
- SHA512
  
  5e9ed7736c8acbdf575ff69f7f7844c2de66ea648445a9a4a5a6c55883b08472cbae4320e10f3dd7eddee1f16a23532a4e6cecdbca3f78cb1ea5e6a94cd0fe6c
- SSDEEP
  
  196608:gpJwe+BtisZuuJZ8CxsL2tThLzdTB1AdDtH0C9SOSAC/:ewYsZuu38CSSlPLOH/gOSAC/
Score

10^/10

cryptolocker bootkit credential_access defense_evasion discovery evasion motw persistence phishing privilege_escalation ransomware spyware stealer trojan
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1