Overview

overview

10

Static

static

3

cryptolock.exe

windows10-2004-x64

10

cryptolock.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cryptolock.exe
  • Size 2.0MB
  • Sample260816-p5ln5abl61
  • SHA256 e6758bffc6026c6966b99bb8d5a2644f30d137407801639c4ab2b1f3e46487fa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\CRYPTOLOCK_DECRYPT_INSTRUCTIONS.html

Ransom Note
  • <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>CRYPTOLOCK - Your Files Are Encrypted</title> <style> * { margin: 0; padding: 0; box-sizing: border-box; } body { background: #0a0a0a; color: #e0e0e0; font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 20px; } .container { max-width: 800px; width: 100%; background: #1a1a1a; border: 2px solid #ff4444; border-radius: 10px; padding: 40px; box-shadow: 0 0 50px rgba(255, 68, 68, 0.3); } .header { text-align: center; border-bottom: 2px solid #ff4444; padding-bottom: 20px; margin-bottom: 30px; } .header h1 { color: #ff4444; font-size: 2.5em; margin-bottom: 10px; } .header .lock-icon { font-size: 4em; margin-bottom: 15px; } .timer-section { text-align: center; margin: 30px 0; padding: 20px; background: #2a2a2a; border-radius: 8px; } .timer-label { color: #888; font-size: 0.9em; margin-bottom: 10px; } .timer { font-size: 3em; font-family: 'Courier New', monospace; color: #ffaa00; font-weight: bold; } .timer.urgent { color: #ff4444; animation: pulse 1s infinite; } @keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.5; } } .payment-section { background: #2a2a2a; border-radius: 8px; padding: 25px; margin: 20px 0; } .payment-section h2 { color: #ffaa00; margin-bottom: 15px; } .payment-section p { margin: 10px 0; line-height: 1.6; } .crypto-address { background: #0a0a0a; padding: 15px; border-radius: 5px; font-family: 'Courier New', monospace; font-size: 0.9em; word-break: break-all; margin: 15px 0; border: 1px solid #444; } .copy-btn { background: #ff4444; color: white; border: none; padding: 10px 20px; border-radius: 5px; cursor: pointer; font-size: 0.9em; margin-top: 10px; } .copy-btn:hover { background: #cc3333; } .instructions { background: #2a2a2a; border-radius: 8px; padding: 25px; margin: 20px 0; } .instructions h2 { color: #38bdf8; margin-bottom: 15px; } .instructions ol { margin-left: 20px; } .instructions li { margin: 10px 0; line-height: 1.6; } .warning { background: #3a2a2a; border: 1px solid #ff4444; border-radius: 8px; padding: 20px; margin: 20px 0; } .warning h3 { color: #ff4444; margin-bottom: 10px; } .warning ul { margin-left: 20px; } .warning li { margin: 8px 0; line-height: 1.5; } .footer { text-align: center; margin-top: 30px; padding-top: 20px; border-top: 1px solid #444; color: #666; font-size: 0.8em; } .status-badge { display: inline-block; padding: 5px 15px; background: #ff4444; color: white; border-radius: 20px; font-size: 0.8em; font-weight: bold; margin-bottom: 15px; } </style> </head> <body> <div class="container"> <div class="header"> <div class="lock-icon">&#128274;</div> <span class="status-badge">ENCRYPTED</span> <h1>CRYPTOLOCK</h1> <p>Your files have been encrypted with military-grade encryption.</p> </div> <div class="timer-section"> <div class="timer-label">TIME REMAINING TO DECRYPT</div> <div class="timer" id="countdown" data-deadline="2026-08-19T12:55:24.936812700+00:00">Loading...</div> </div> <div class="payment-section"> <h2>Payment Details</h2> <p><strong>Amount:</strong> 0.5 XMR (Monero)</p> <p><strong>Currency:</strong> Monero (XMR) - Untraceable cryptocurrency</p> <p><strong>Send payment to:</strong></p> <div class="crypto-address" id="address">44AFFq5kSiGBoZ4NMDwYtN18obc8AemS33DBLWs3H7otXft3XjrpDtQGv7SqSsaBYBb98uNbr2VBBEt7f2wfn3RVGQBEP3A</div> <button class="copy-btn" onclick="copyAddress()">Copy Address</button> <p id="copy-status" style="margin-top: 10px; color: #22c55e; display: none;">Address copied!</p> </div> <div class="instructions"> <h2>How to Decrypt Your Files</h2> <ol> <li>Download the Monero wallet from <a href="https://www.getmonero.org" style="color: #38bdf8;">getmonero.org</a></li> <li>Purchase 0.5 XMR from a cryptocurrency exchange</li> <li>Send exactly 0.5 XMR to the address above</li> <li>After payment is confirmed, your decryption key will be available</li> <li>Use the decryption tool to restore your files</li> </ol> </div> <div class="warning"> <h3>&#9888; Important Warnings</h3> <ul> <li>Do NOT attempt to decrypt files manually - this will corrupt them permanently</li> <li>Do NOT delete or rename encrypted files - this will prevent decryption</li> <li>Do NOT use third-party decryption tools - they will damage your files</li> <li>Payment must be made within the time limit or keys will be deleted</li> <li>After the deadline, the price will increase by 2x</li> </ul> </div> <div class="footer"> <p>CRYPTOLOCK v1.0 | Machine ID: <span id="machine-id">loading...</span></p> <p>For support, contact us via the Monero blockchain message system.</p> </div> </div> <script> function updateCountdown() { const deadline = new Date(document.getElementById('countdown').dataset.deadline).getTime(); const now = new Date().getTime(); const distance = deadline - now; if (distance < 0) { document.getElementById('countdown').innerHTML = "EXPIRED"; document.getElementById('countdown').classList.add('urgent'); return; } const days = Math.floor(distance / (1000 * 60 * 60 * 24)); const hours = Math.floor((distance % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); const minutes = Math.floor((distance % (1000 * 60 * 60)) / (1000 * 60)); const seconds = Math.floor((distance % (1000 * 60)) / 1000); document.getElementById('countdown').innerHTML = `${days}d ${hours.toString().padStart(2, '0')}h ${minutes.toString().padStart(2, '0')}m ${seconds.toString().padStart(2, '0')}s`; if (days === 0 && hours < 12) { document.getElementById('countdown').classList.add('urgent'); } } function copyAddress() { const address = document.getElementById('address').innerText; navigator.clipboard.writeText(address).then(() => { document.getElementById('copy-status').style.display = 'block'; setTimeout(() => { document.getElementById('copy-status').style.display = 'none'; }, 2000); }); } updateCountdown(); setInterval(updateCountdown, 1000); fetch('/api/v1/machine-id') .then(r => r.json()) .then(d => document.getElementById('machine-id').innerText = d.machine_id) .catch(() => document.getElementById('machine-id').innerText = 'unknown'); </script> </body> </html>

Extracted

Path

  • C:\CRYPTOLOCK_DECRYPT_INSTRUCTIONS.html

Ransom Note
  • <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>CRYPTOLOCK - Your Files Are Encrypted</title> <style> * { margin: 0; padding: 0; box-sizing: border-box; } body { background: #0a0a0a; color: #e0e0e0; font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 20px; } .container { max-width: 800px; width: 100%; background: #1a1a1a; border: 2px solid #ff4444; border-radius: 10px; padding: 40px; box-shadow: 0 0 50px rgba(255, 68, 68, 0.3); } .header { text-align: center; border-bottom: 2px solid #ff4444; padding-bottom: 20px; margin-bottom: 30px; } .header h1 { color: #ff4444; font-size: 2.5em; margin-bottom: 10px; } .header .lock-icon { font-size: 4em; margin-bottom: 15px; } .timer-section { text-align: center; margin: 30px 0; padding: 20px; background: #2a2a2a; border-radius: 8px; } .timer-label { color: #888; font-size: 0.9em; margin-bottom: 10px; } .timer { font-size: 3em; font-family: 'Courier New', monospace; color: #ffaa00; font-weight: bold; } .timer.urgent { color: #ff4444; animation: pulse 1s infinite; } @keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.5; } } .payment-section { background: #2a2a2a; border-radius: 8px; padding: 25px; margin: 20px 0; } .payment-section h2 { color: #ffaa00; margin-bottom: 15px; } .payment-section p { margin: 10px 0; line-height: 1.6; } .crypto-address { background: #0a0a0a; padding: 15px; border-radius: 5px; font-family: 'Courier New', monospace; font-size: 0.9em; word-break: break-all; margin: 15px 0; border: 1px solid #444; } .copy-btn { background: #ff4444; color: white; border: none; padding: 10px 20px; border-radius: 5px; cursor: pointer; font-size: 0.9em; margin-top: 10px; } .copy-btn:hover { background: #cc3333; } .instructions { background: #2a2a2a; border-radius: 8px; padding: 25px; margin: 20px 0; } .instructions h2 { color: #38bdf8; margin-bottom: 15px; } .instructions ol { margin-left: 20px; } .instructions li { margin: 10px 0; line-height: 1.6; } .warning { background: #3a2a2a; border: 1px solid #ff4444; border-radius: 8px; padding: 20px; margin: 20px 0; } .warning h3 { color: #ff4444; margin-bottom: 10px; } .warning ul { margin-left: 20px; } .warning li { margin: 8px 0; line-height: 1.5; } .footer { text-align: center; margin-top: 30px; padding-top: 20px; border-top: 1px solid #444; color: #666; font-size: 0.8em; } .status-badge { display: inline-block; padding: 5px 15px; background: #ff4444; color: white; border-radius: 20px; font-size: 0.8em; font-weight: bold; margin-bottom: 15px; } </style> </head> <body> <div class="container"> <div class="header"> <div class="lock-icon">&#128274;</div> <span class="status-badge">ENCRYPTED</span> <h1>CRYPTOLOCK</h1> <p>Your files have been encrypted with military-grade encryption.</p> </div> <div class="timer-section"> <div class="timer-label">TIME REMAINING TO DECRYPT</div> <div class="timer" id="countdown" data-deadline="2026-08-19T12:55:43.648479+00:00">Loading...</div> </div> <div class="payment-section"> <h2>Payment Details</h2> <p><strong>Amount:</strong> 0.5 XMR (Monero)</p> <p><strong>Currency:</strong> Monero (XMR) - Untraceable cryptocurrency</p> <p><strong>Send payment to:</strong></p> <div class="crypto-address" id="address">44AFFq5kSiGBoZ4NMDwYtN18obc8AemS33DBLWs3H7otXft3XjrpDtQGv7SqSsaBYBb98uNbr2VBBEt7f2wfn3RVGQBEP3A</div> <button class="copy-btn" onclick="copyAddress()">Copy Address</button> <p id="copy-status" style="margin-top: 10px; color: #22c55e; display: none;">Address copied!</p> </div> <div class="instructions"> <h2>How to Decrypt Your Files</h2> <ol> <li>Download the Monero wallet from <a href="https://www.getmonero.org" style="color: #38bdf8;">getmonero.org</a></li> <li>Purchase 0.5 XMR from a cryptocurrency exchange</li> <li>Send exactly 0.5 XMR to the address above</li> <li>After payment is confirmed, your decryption key will be available</li> <li>Use the decryption tool to restore your files</li> </ol> </div> <div class="warning"> <h3>&#9888; Important Warnings</h3> <ul> <li>Do NOT attempt to decrypt files manually - this will corrupt them permanently</li> <li>Do NOT delete or rename encrypted files - this will prevent decryption</li> <li>Do NOT use third-party decryption tools - they will damage your files</li> <li>Payment must be made within the time limit or keys will be deleted</li> <li>After the deadline, the price will increase by 2x</li> </ul> </div> <div class="footer"> <p>CRYPTOLOCK v1.0 | Machine ID: <span id="machine-id">loading...</span></p> <p>For support, contact us via the Monero blockchain message system.</p> </div> </div> <script> function updateCountdown() { const deadline = new Date(document.getElementById('countdown').dataset.deadline).getTime(); const now = new Date().getTime(); const distance = deadline - now; if (distance < 0) { document.getElementById('countdown').innerHTML = "EXPIRED"; document.getElementById('countdown').classList.add('urgent'); return; } const days = Math.floor(distance / (1000 * 60 * 60 * 24)); const hours = Math.floor((distance % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); const minutes = Math.floor((distance % (1000 * 60 * 60)) / (1000 * 60)); const seconds = Math.floor((distance % (1000 * 60)) / 1000); document.getElementById('countdown').innerHTML = `${days}d ${hours.toString().padStart(2, '0')}h ${minutes.toString().padStart(2, '0')}m ${seconds.toString().padStart(2, '0')}s`; if (days === 0 && hours < 12) { document.getElementById('countdown').classList.add('urgent'); } } function copyAddress() { const address = document.getElementById('address').innerText; navigator.clipboard.writeText(address).then(() => { document.getElementById('copy-status').style.display = 'block'; setTimeout(() => { document.getElementById('copy-status').style.display = 'none'; }, 2000); }); } updateCountdown(); setInterval(updateCountdown, 1000); fetch('/api/v1/machine-id') .then(r => r.json()) .then(d => document.getElementById('machine-id').innerText = d.machine_id) .catch(() => document.getElementById('machine-id').innerText = 'unknown'); </script> </body> </html>

Targets

    • Target
      cryptolock.exe
    • Size 2.0MB
    • SHA256 e6758bffc6026c6966b99bb8d5a2644f30d137407801639c4ab2b1f3e46487fa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Enumerates VirtualBox DLL files

    • Looks for VirtualBox drivers on disk

      defense_evasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

4
T1059

PowerShell

2
T1059.001

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

File and Directory Discovery

2
T1083

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Query Registry

2
T1012

System Information Discovery

2
T1082

System Time Discovery

1
T1124

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3
T1490

Tasks