Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/04/2024, 03:48
General
-
Target
2024-04-11_bd0e058401b9c3dc47b5fa8e8cd687b8_cryptolocker.exe
-
Size
63KB
-
MD5
bd0e058401b9c3dc47b5fa8e8cd687b8
-
SHA1
6a8d52d8e3dee99fed865639b9526235f3644358
-
SHA256
4fe6c5be985a5274713ef7e4c58639fc0bca344dd0f926c566440615ff92416d
-
SHA512
3e0ce5fc0b6ca63930bc465725d71b1ceaa1c4423f68a46657c89fdc0860989635193363217329529809a15b1ce857355d220793ad49b1457dbf442afcf13643
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgts7:BbdDmjr+OtEvwDpjM8j
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_bd0e058401b9c3dc47b5fa8e8cd687b8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_bd0e058401b9c3dc47b5fa8e8cd687b8_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5716efb7d3ddf32867f4ccc560aecbde2
SHA16243041eeb6050e39dd20734c8408ca65d3300f7
SHA256c977d97bac21e3f43f96f472ad1c8cc1aa74b32c64f30b603cc08d473d29fb03
SHA51257d429e42088c212ede36ca72bc401c55bcd088c117ff90edbc429627da90677e14b445e73e43b07c6e215aef853cef159f12439aec4d86d13b311f1c61564bf
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB