Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
14-03-2024 23:53
General
-
Target
2024-03-14_de47ff97b4894230565258bf2593e1b5_cryptolocker.exe
-
Size
60KB
-
MD5
de47ff97b4894230565258bf2593e1b5
-
SHA1
99d85983c6508d19de251c4503049c3355673d88
-
SHA256
aa4d382bf8d7b3151431cc8d7f72ab628a5b2f42c7278e568550d3eacc04a2b6
-
SHA512
f8f6eed6627fcf1b86b7c7edd640823575fdf3abb41c7451b5d37b3eb1a1c07e182bd816a540ab058a73449a906faf6fe6a4103631ab1f3f7579f663fad6f00b
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6144:BbdDmjr+OtEvwDpjMz
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_de47ff97b4894230565258bf2593e1b5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_de47ff97b4894230565258bf2593e1b5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5c52e86f5ad3b756669b7ab1ae02e8589
SHA1423e5f50f95be34edb80611c0d81124ce4bc3b0e
SHA2560d60f94bae5833058ec932309abe2b8eb37ce9e3dd6ec7eb1f1278b05d902ad9
SHA51217ff5a92aad9e04f4dbb9982e754a3c2842abf7f2ad4f818d9e4bb53a7ef871300b3b4670bfd984fe4776cda23273955608aab0adc24ba4a566ed283ee1a685d
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB