Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
04/02/2024, 14:22
General
-
Target
2024-02-04_0f7a791a6cb569c9c8fc97a143a134e2_cryptolocker.exe
-
Size
51KB
-
MD5
0f7a791a6cb569c9c8fc97a143a134e2
-
SHA1
5bc8036e51b7d3ac4ce2a7d986a8042af2407869
-
SHA256
069fdfd66e18b1440121ea717e717358397bd64b1ef9fd2d4a38a5ddc6299cb5
-
SHA512
37f17042a798c6ea2449a75854ab62d0417effb60eaa2d4b3c592496077125763880690088b31a01a535b52e9f3003eda5c163e98ceb5d9396916d7e62ac7586
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6Impyx:BbdDmjr+OtEvwDpjMW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_0f7a791a6cb569c9c8fc97a143a134e2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_0f7a791a6cb569c9c8fc97a143a134e2_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5a6eb7dfbd44dd2e01220ea6cae1bfbd7
SHA162b19531517c80fec313683010b4dd67fc35dd9c
SHA2569eeb0dbee7e2844e286851568cb9e982e59a3609e86b83a15383d3b5e986af14
SHA5124cb7cd93ffdc99778cdcc671bc030f23bffe7266f4a92f42df8bbfa1808fb2614c264b33acdc78a0c268be41d080d9286d578af926879d104bee81431e3871f9
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB