f3a3bc122b81951bf17926820903f6742c5658e88242159e2cf53bc191ba3e90 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-25_55a64a7618a568a12122ecb7a6cd0abf_cryptolocker
Size

33KB
Sample

240925-e35n4sybme
MD5

55a64a7618a568a12122ecb7a6cd0abf
SHA1

52bd672c18e17965ce1ab6f7101c4f150bcf52c4
SHA256

f3a3bc122b81951bf17926820903f6742c5658e88242159e2cf53bc191ba3e90
SHA512

cf838d777b5e0d3411d34b18c99e0dd84364c7fb75ba5447384f61aeed19a9f7383c9aeb9d834632c92b16444ab073a5e66733a5a244558b72b416b8be7f3713
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzZ8PigUyprCz/fDgTt4:b/yC4GyNM01GuQMNXZ8ZUypw3Dj

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  2024-09-25_55a64a7618a568a12122ecb7a6cd0abf_cryptolocker
- Size
  
  33KB
- MD5
  
  55a64a7618a568a12122ecb7a6cd0abf
- SHA1
  
  52bd672c18e17965ce1ab6f7101c4f150bcf52c4
- SHA256
  
  f3a3bc122b81951bf17926820903f6742c5658e88242159e2cf53bc191ba3e90
- SHA512
  
  cf838d777b5e0d3411d34b18c99e0dd84364c7fb75ba5447384f61aeed19a9f7383c9aeb9d834632c92b16444ab073a5e66733a5a244558b72b416b8be7f3713
- SSDEEP
  
  384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzZ8PigUyprCz/fDgTt4:b/yC4GyNM01GuQMNXZ8ZUypw3Dj
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2