cryptolocker | 4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d | Triage

Sharing

General

Target

b07325f2686e5c26791424d9de7a5c54_JaffaCakes118
Size

360KB
Sample

241129-lwxs9aypdz
MD5

b07325f2686e5c26791424d9de7a5c54
SHA1

f7d4163877616c819758c07c8c926a9b60c844fa
SHA256

4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d
SHA512

8f4824daef0b9bf70b7de5994baad455e4a1153c0f3976ebcf2f4b061c77a124f8ca0db9455a6bd8d36cb1c1c7e583964b951eb93571f1aa2c277f91775429b4
SSDEEP

6144:7Y56KnPgfagNgMhJAp/WgTO3x5N22vWvLRKKAX5l++SyVI4H:qdgfpN/AxT85I2vCMX5l+Zn

Score

10^/10

cryptolocker discovery persistence ransomware

Malware Config

Targets

- Target
  
  b07325f2686e5c26791424d9de7a5c54_JaffaCakes118
- Size
  
  360KB
- MD5
  
  b07325f2686e5c26791424d9de7a5c54
- SHA1
  
  f7d4163877616c819758c07c8c926a9b60c844fa
- SHA256
  
  4a19518be677153ab92e1208e7507dd6adef0de0fa34295dfa5d7ac9efce176d
- SHA512
  
  8f4824daef0b9bf70b7de5994baad455e4a1153c0f3976ebcf2f4b061c77a124f8ca0db9455a6bd8d36cb1c1c7e583964b951eb93571f1aa2c277f91775429b4
- SSDEEP
  
  6144:7Y56KnPgfagNgMhJAp/WgTO3x5N22vWvLRKKAX5l++SyVI4H:qdgfpN/AxT85I2vCMX5l+Zn
Score

10^/10

cryptolocker discovery persistence ransomware
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Cryptolocker family
  cryptolocker
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cryptolockerdiscoverypersistenceransomware

behavioral2

cryptolockerdiscoverypersistenceransomware