3ba4763edc0c811610f5bda0f505ee300ba3167dc3288c434c86bbcf5bbdb181 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-29_5755c7a42d8307d80f7939689acdb7e1_cryptolocker
Size

31KB
Sample

240929-bses6avamr
MD5

5755c7a42d8307d80f7939689acdb7e1
SHA1

5a2304eae55a018bfe1c16927f392198b6fc7829
SHA256

3ba4763edc0c811610f5bda0f505ee300ba3167dc3288c434c86bbcf5bbdb181
SHA512

e964a7084079d4fb90d63549f38cc418b8af5d66a81683627939e5b62121f3e8ab7619ae467aef19f3513a67f343ae0b4b5bdd13345a5c1daf20f3eecc61bb18
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznStEEr9VES:b/yC4GyNM01GuQMNXw2PSjSKEBVES

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  2024-09-29_5755c7a42d8307d80f7939689acdb7e1_cryptolocker
- Size
  
  31KB
- MD5
  
  5755c7a42d8307d80f7939689acdb7e1
- SHA1
  
  5a2304eae55a018bfe1c16927f392198b6fc7829
- SHA256
  
  3ba4763edc0c811610f5bda0f505ee300ba3167dc3288c434c86bbcf5bbdb181
- SHA512
  
  e964a7084079d4fb90d63549f38cc418b8af5d66a81683627939e5b62121f3e8ab7619ae467aef19f3513a67f343ae0b4b5bdd13345a5c1daf20f3eecc61bb18
- SSDEEP
  
  384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznStEEr9VES:b/yC4GyNM01GuQMNXw2PSjSKEBVES
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2