Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14-02-2024 14:59
General
-
Target
2024-02-14_e1bc11e44429fc018df236c380df4f91_cryptolocker.exe
-
Size
34KB
-
MD5
e1bc11e44429fc018df236c380df4f91
-
SHA1
5a70e777388bc7c6f8e1a2f46fa08f00bbfd4c4d
-
SHA256
bf743ebd98b5d87727babc4d4d8490f7d95071865eebd1e6e8818af6a1add540
-
SHA512
541fb6aa8de91e92fc1a21c2e99de6545f6950199bb628e36727253f5c207d99c95b135868880ef7cf8f90c0fd00b05594a01ba12719c12b0a6001c3fb3e42fd
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoWDS:qmbhXDmjr5MOtEvwDpj5cDJ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_e1bc11e44429fc018df236c380df4f91_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_e1bc11e44429fc018df236c380df4f91_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5d3a2f42d1768cd47d15cd15b57f0cb0e
SHA1306b7bba10ba2d6e4cb346b63ddb9b6acedfa05f
SHA2566a9a7325b66f6dedd515a1dcf054bfebc9e253991fe343d6efb2a585b35f8c9c
SHA5128d3ec3b98da7e4493fb5e6d297a0e71b05f63d0ec76759e4b49651f24e04ff4eb79546deace8b6cf7bc3c7ab8b42f0d08f052e088e6a2fa0a793ca8c0128fe50
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB