Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22-02-2024 09:59
General
-
Target
2024-02-22_af8a1a5490e717a13090f03157bd88ad_cryptolocker.exe
-
Size
56KB
-
MD5
af8a1a5490e717a13090f03157bd88ad
-
SHA1
3f616dcd6155f884831357c6da41ef1dffe5fe55
-
SHA256
74bbd8981c54d0746e7fe39834674dca4fd7b31bc97743f192910d92f1675f83
-
SHA512
6e17dd2c4f408fc3a4e3b08dc20b911e080de53d40403fccdf1b547fc5d1668ed5bc0ada0d2d8da5a32f2cb9b3735bb732b815c3d67e507fb264862691ce271f
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61I:BbdDmjr+OtEvwDpjM6
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_af8a1a5490e717a13090f03157bd88ad_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_af8a1a5490e717a13090f03157bd88ad_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD508f3555e34d53e726eacd10aa49a3572
SHA1c0734f7836b21bb69ddad0ca1167efe23671fa99
SHA256b3c5567f2f6e9ddf94a576110534a094894d11bb764e819d7d5e5e1560607a2e
SHA5121e6573e0c889a10bc4e23eb83b26016e836d10ce47aa47b4b2d6f68a7b8604085738f4a532d5aea1f108c98649a0ad6bf35394b47e118357224031292c6f20be
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB