Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13/03/2024, 01:47
General
-
Target
2024-03-13_978159c83931e19f6760e67b8602706a_cryptolocker.exe
-
Size
32KB
-
MD5
978159c83931e19f6760e67b8602706a
-
SHA1
ae4763d09bdaabf631df3c7de2005c81acda327b
-
SHA256
8def9f13e4db1332f62d7a693699f9e2caf243baffe96d114fb0f770e5c3fa72
-
SHA512
73c4858dab161d216377c04661e8af958bff68659eaaa3c9aa4d6c585be3c421db31aecc05d777b567d36bf83a2050d72864fafcdbb8bad2c5af8444d0e4ec57
-
SSDEEP
768:q0ZziOWwULueOSdE8tOOtEvwDpjeWaJIOc+4tHmNgt:q0zizzOSxMOtEvwDpj/arqcY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_978159c83931e19f6760e67b8602706a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_978159c83931e19f6760e67b8602706a_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5adcdba8bafb80216192c2eff36d938cf
SHA1bfd940ab294f429301a400f5b0296befe9e8807b
SHA2566759c39d215de6533ffe6afe8dfe553afd74969f0f7f820de67f0f35c352e9e2
SHA512bc4b7a85996490c8477f38c51533aa5bcdb5ebf215813c06b20527ff6281e3f425189a31879332550818055a850ce0caa58ad007f942d249a5a234d5469d840c
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB