Analysis
-
max time kernel
1s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
18/01/2024, 22:26
General
-
Target
2024-01-18_1224efdae504c2e1980f0ba97c27379e_cryptolocker.exe
-
Size
33KB
-
MD5
1224efdae504c2e1980f0ba97c27379e
-
SHA1
9764414cd69abb29bbab93616eee854c7687e79c
-
SHA256
6741218d1cbf5f8cf6626e79c7437fbe8e5bf55be6899dd9ded82f9c06f96106
-
SHA512
0a3250cbffecdf560e21c2292e56ddc7123cf486ea1791945e9002c3e654cf68e880b661f0b6ae2a3f10bdc18556f4fef7d1b70ea2599847d4062532c5de405a
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmo/bj:qmbhXDmjr5MOtEvwDpj5cD/H
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_1224efdae504c2e1980f0ba97c27379e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_1224efdae504c2e1980f0ba97c27379e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD594cad0bb193bbc1f025bf94fc034b4d5
SHA176346fe78a56e5f57f89f0015fb444d083a5b2d8
SHA2561069e6a9ce14b9dd1e494f6d60d008c95cb6930bfad4c596df5d9ae31d59409b
SHA5128e5c33b00bfec1f4a2794f76d949f3944672c6f5990d6ce996b8ca20093856ab61260f5f667652083d2194b9cd0bbef404038965675094cf66151bee009ddab9
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB