Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/04/2024, 15:29
General
-
Target
2024-04-08_1a50d25d5f4a6fb65239f2106078ff7f_cryptolocker.exe
-
Size
53KB
-
MD5
1a50d25d5f4a6fb65239f2106078ff7f
-
SHA1
535fbd373f6b59ffd15ab887a28ed47ef6a21284
-
SHA256
18798b95e450cc73e096b980a433efdeacf3a822a7ec90a3ed53b731e510cb3e
-
SHA512
68394e492012091e73b5de962b4caab8f97b494c5a209570637f21b381c236f66a862b73e2fd8408cac124c77d53d677777e20cf949dd44a61c1a4f0b58bcb19
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6ImpyU:BbdDmjr+OtEvwDpjM3
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_1a50d25d5f4a6fb65239f2106078ff7f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_1a50d25d5f4a6fb65239f2106078ff7f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5e011d35f531ab4a23dc8a1b18bef07ab
SHA1cdf14795f4ba4f9d664ba18babcd697c921e20f0
SHA2561d3e862c21f0211b9aceb2027359a43d44d004635160b743e65287b73c22943c
SHA512f4046babd647b56941d3084497a5391eb500ae98bfb33f18030bf3f116a0b9fb66842866ec21ab75362b64a79a5a8086a815635afa182e76c39f08f346843f36
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB