Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
13-02-2024 07:33
General
-
Target
2024-02-13_35c36967fff34ef31d1e9ed1c85e8510_cryptolocker.exe
-
Size
31KB
-
MD5
35c36967fff34ef31d1e9ed1c85e8510
-
SHA1
4eeb60e118ee39d4e8111138e755ecedf9dcc1cd
-
SHA256
4aeff636c69e55fb3a79946e7af94cdf5b5ff51d6d93135e7e5fb58bd3c6ab58
-
SHA512
85ac0250dd86763eabf6747e70b84e6e0be89816756a27eb2b20d6de111738681b4f07b10f14b6bc12ac82fc632e7640f6c718d9fdfe8df99c31023200bd7437
-
SSDEEP
768:q0ZziOWwULueOSdE8tOOtEvwDpjeWaJIOc+4tHmNJ:q0zizzOSxMOtEvwDpj/arqcJ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_35c36967fff34ef31d1e9ed1c85e8510_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_35c36967fff34ef31d1e9ed1c85e8510_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD52559f133fec0582f5e2ed116376b6ba9
SHA1457572042d98dd9876aab5a200d1fd23d63a8ea5
SHA2561d2d7bfcf05f1ede2d7a557e8b19db951b028c8257834bd7bfaf54e53d2f0ee0
SHA512f32e05f362231719804ade0249834eea87fdfc83b5ba72080d85efac03fd66c9b5962cd0bfb917ae90af1414a5bd6bf8522d0cbbee911c8d44f62239e5a51e6b
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB