General
-
Target
2024-05-27_a1911cf727fe388c5a6806262a0a78ef_cryptolocker
-
Size
41KB
-
Sample
240527-w9v7pade71
-
MD5
a1911cf727fe388c5a6806262a0a78ef
-
SHA1
67ed1ddc0eee967d8e3d894df0b1a494b91948de
-
SHA256
96b4bd5b7368b7edebc5a515978c32be9373046ec3488cb1ae6741eb8519c548
-
SHA512
fd617374bd764ab99e18193f1cb756f8d9bb3dea299f8b86824f74285b901434db23f49f53b9007d38f0ad1862801f1ae185f2bea2d13f0a78da9de710ca1695
-
SSDEEP
384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AJvDSuYlmoHR8uyvT:b/yC4GyNM01GuQMNXw2PSjHPbSuYlZ6T
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_a1911cf727fe388c5a6806262a0a78ef_cryptolocker.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-27_a1911cf727fe388c5a6806262a0a78ef_cryptolocker.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
2024-05-27_a1911cf727fe388c5a6806262a0a78ef_cryptolocker
-
Size
41KB
-
MD5
a1911cf727fe388c5a6806262a0a78ef
-
SHA1
67ed1ddc0eee967d8e3d894df0b1a494b91948de
-
SHA256
96b4bd5b7368b7edebc5a515978c32be9373046ec3488cb1ae6741eb8519c548
-
SHA512
fd617374bd764ab99e18193f1cb756f8d9bb3dea299f8b86824f74285b901434db23f49f53b9007d38f0ad1862801f1ae185f2bea2d13f0a78da9de710ca1695
-
SSDEEP
384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AJvDSuYlmoHR8uyvT:b/yC4GyNM01GuQMNXw2PSjHPbSuYlZ6T
Score9/10-
Detection of CryptoLocker Variants
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-