Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/02/2024, 01:25
General
-
Target
2024-02-19_232b22a8a4901557415eebb813d2aa7e_cryptolocker.exe
-
Size
51KB
-
MD5
232b22a8a4901557415eebb813d2aa7e
-
SHA1
6e3cd285f3b5d9f3ff103ec1f9c1bb83446b8f5a
-
SHA256
6cc0a39a4984b85df8053bde08da2a087f4edcbe6f476ef5314c6d6fc831b00f
-
SHA512
e83cf2969f28bdd02c24d2d7af514ab78bbdc8017937caa1c30946b3ed5364e4441c0a88cb7e7a37f8c831b3f4dc38011a565938992b26306b5281c622a6ad18
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6Impy9:BbdDmjr+OtEvwDpjMy
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_232b22a8a4901557415eebb813d2aa7e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_232b22a8a4901557415eebb813d2aa7e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD51cde256b0ab26bf8e4050a1f2c613538
SHA11e63a1c9abac2d4ca5033b2da8a5b4c6074158c9
SHA25617d308158935c5a9ff71fd8c46b5ec0beefedda1226b302c2d841d8bb0623fb4
SHA512ca1cb8be85b953c0f05afd9e47b383dff06130942fdba8374c51e28e2a66de653b894648e5c19dd10d0172e321efe7ce0770da11a7ce6b5e52c1746aca14e5b8
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB