Analysis
-
max time kernel
155s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/03/2024, 04:58
General
-
Target
2024-03-09_dae1b0d5085dc00707d6aa7204e8aab1_cryptolocker.exe
-
Size
62KB
-
MD5
dae1b0d5085dc00707d6aa7204e8aab1
-
SHA1
3e4bf05a4bd2d16fb28658610cd6aabd1c482c75
-
SHA256
d465af2ff6f1765256950e192cbb04ea158820d8f1481f97ef185feb40e58e3d
-
SHA512
b9dc09b007ace01171362779c6dfb5f44f60da396b4ccff146b1ac14247bff602a993a8aaf0267802fb2c1de3799fdb288b8aeebf953ae1a1e2ee0b1e348a3e6
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgts7:BbdDmjr+OtEvwDpjM8j
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_dae1b0d5085dc00707d6aa7204e8aab1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_dae1b0d5085dc00707d6aa7204e8aab1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5fea9b5e5b41ad6647af308351e602636
SHA1ee961e3550772f1c85691af1e5f9dd2bd71575aa
SHA256e661b4de734d2ba5d3ba6089910f7e6d809f41a1a165bb7e43720cfc7679fa01
SHA5126f9ad5b696ac4aeedcaa7e69359d84f36403b380e191ff853be7b298c79dff41435ab60c9818581abae13b1c7dbb526cb0babaf38fc21d6241599895de585188
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB