Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04-02-2024 00:27
General
-
Target
2024-02-04_445ae8b214357bdd9ae7099223a9897d_cryptolocker.exe
-
Size
56KB
-
MD5
445ae8b214357bdd9ae7099223a9897d
-
SHA1
1fd5c831781576e7eceac417586e2f811c2f85ec
-
SHA256
b8b780a1134448aca6ef4b1183ed53a8a0b624814d401b3f92b4a29116ee46fd
-
SHA512
98b599324905d101c848a5b064c36d73431a59aefcca74446a969b8fd91f5e9d5af6762c64a608036b6a0808edca869502db2c3c6eead79305e5dbc4accb732e
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61W:BbdDmjr+OtEvwDpjMs
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_445ae8b214357bdd9ae7099223a9897d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_445ae8b214357bdd9ae7099223a9897d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5cb828365ca68607f8c65f83d4c577ede
SHA1b576d7a24237abdfabbcdb6cde85360ed58c6d31
SHA2564015ef9b84002e7aff9894d6f32b1afd9de2754a4ad11e60900f6caf9e2d126f
SHA512c924fe6ab32e74494c3e30b251fdcab3086fda970960e882af1d34c535f7296cc1a79877a761e984ea60f928d3de0cd809d3d2e03841de0b564f76f13968a038
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB