Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-02-2024 09:23
General
-
Target
2024-02-01_9d3defaa4516e60d9afee2cb30f03fac_cryptolocker.exe
-
Size
60KB
-
MD5
9d3defaa4516e60d9afee2cb30f03fac
-
SHA1
6e281474026d1b0603eeedf42bd6e55a143f090c
-
SHA256
2bd3ba82bc1d41d1734e6530f2d3be0fa97c82e7f47c08bda30756cfa03f34af
-
SHA512
f6ebb108f5f6e351a99d016e57d1e5641d9392e0c4d4bbed0a8b31a5ce2302299fcd28e0a770b1fb05a2e6a503dabbfa64af34099b5f6d93ec75a507f95812c2
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgts0:BbdDmjr+OtEvwDpjM8c
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_9d3defaa4516e60d9afee2cb30f03fac_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_9d3defaa4516e60d9afee2cb30f03fac_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5dfebe96eb1fd3675649a0dea13de6e9d
SHA1fecb9755c8cff5c67a0c465b7cfabedcd1229abb
SHA256812889d476ab2dfe53b541a6c373ab024c3adce8fa9e5365c3c513ac3c293939
SHA5124fe48bf94ecfd3d8f6fd2b8f06e177f3f18d2b71ab861e994a21f3dec8c4702eb6c48da938ef3ebcb6ed4b19b9dec7038fdedc3289998c1d27d216972c878ca8
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB