20efe6a58e1e0aae88947ac46450b53f397ebc6fd0ff1a69493b143c0be50ff6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe
Size

31KB
Sample

231023-vxe49sbc7x
MD5

cecee9eb9e5d66ec00c18b42c65b302a
SHA1

67d408e0e4135419ac4aab9b8ffa3d363807a6fd
SHA256

20efe6a58e1e0aae88947ac46450b53f397ebc6fd0ff1a69493b143c0be50ff6
SHA512

2afb80c31d16d47fedade8798b6703f3a626736d704b9b3de00bbc4547ebde3f05ee8ea4b8d8cc179c24a80ccf03a590589546a2fb057f441bdbc6632108dd92
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AmfS:b/yC4GyNM01GuQMNXw2PSjHWS

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe
- Size
  
  31KB
- MD5
  
  cecee9eb9e5d66ec00c18b42c65b302a
- SHA1
  
  67d408e0e4135419ac4aab9b8ffa3d363807a6fd
- SHA256
  
  20efe6a58e1e0aae88947ac46450b53f397ebc6fd0ff1a69493b143c0be50ff6
- SHA512
  
  2afb80c31d16d47fedade8798b6703f3a626736d704b9b3de00bbc4547ebde3f05ee8ea4b8d8cc179c24a80ccf03a590589546a2fb057f441bdbc6632108dd92
- SSDEEP
  
  384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AmfS:b/yC4GyNM01GuQMNXw2PSjHWS
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2