Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28/02/2024, 05:44
General
-
Target
2024-02-28_f8cf43880df5d28bb885af753c89bad7_cryptolocker.exe
-
Size
26KB
-
MD5
f8cf43880df5d28bb885af753c89bad7
-
SHA1
ed9eb69b9d842a2f3e929b637328a9932e1a0ba4
-
SHA256
42704ad035fe6dff8a206f405a808721c03db958826a6f53eb6c5586a05b19a7
-
SHA512
868ced39e01eb46b6697adf5dc9ec972eefdc899d1f1e01e5b21246dd5b6a9dfdc66918724a1d0b65f3472aeca58cdb4f75d3ada77765b336d4293870c61c328
-
SSDEEP
384:qxOZzyjOnqGAs+8ULueO4NdE8tOOtEvwDpjqIGRYK1sGGYkxlma:q0ZziOWwULueOSdE8tOOtEvwDpjeol
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_f8cf43880df5d28bb885af753c89bad7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_f8cf43880df5d28bb885af753c89bad7_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD5a9b86b988ec28cb88f6d8eac5eb3a819
SHA1eb0d99bb887aee1196dea1397647bc4f7162effd
SHA2564e29ddea070ab7c0853b82d9544b535f8e6cd773e3ad392f83bc8ff9447a5bda
SHA51257a20143cdf97bb223005ec0e7a8f0a2d317c963f671e286aca722b22c8933cfc3f56412c9c542bc4c3db1d71341229f4c27e9d33ce2c2af25ccdddac2d96a21
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB