Analysis
-
max time kernel
153s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03/02/2024, 08:34
General
-
Target
2024-02-03_95f91abd5aad398828d772291b74be7b_cryptolocker.exe
-
Size
59KB
-
MD5
95f91abd5aad398828d772291b74be7b
-
SHA1
52b74938d1aab25fed47c575bdf2010b658e1d29
-
SHA256
9200154c81fac0d1105fc064145d39a30d2bd149613211d75f7e092c5da1bde0
-
SHA512
891b24abee99d025717b78a1a3e347353d8b8f398bc7f94c868650096a929a0ed2e6e425db872f78e4df7fe6bd7e75ba4a5bdb34df73843e16ebecf50a183422
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgts+:BbdDmjr+OtEvwDpjM8m
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_95f91abd5aad398828d772291b74be7b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_95f91abd5aad398828d772291b74be7b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD548fa6f841841a330c791924b49fa30b6
SHA1369961e9053b9290c8f5027649f8d07674000425
SHA256c1f432d4b30694485d3f348f3dbdc27a8b4766e5b8317ab21cd3a3488ea3f1ea
SHA512114e36262e10b50d6cd293a203e476613228a1f1b672c75665520e1b09ee8a9e508a6d8ddc260e138b48a64bfee9a105bbd3e91864209061d25ef8f051a4344c
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB