Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
16-04-2024 15:23
General
-
Target
2024-04-16_0013d56be2b2d920b95fbaef11a3db82_cryptolocker.exe
-
Size
61KB
-
MD5
0013d56be2b2d920b95fbaef11a3db82
-
SHA1
3d1d31840ce49c1ec4b98157b63f52b0d2a53655
-
SHA256
da7e28b50f1c8aa2d25149ce0260fa5eb80e49da9a2f13e99c2bd3543c5bab5e
-
SHA512
17da0a32d0e2970ae4bd65d1df9c5cd656f43168aa92e6e481974bbfdafb3c65211cc86d433907ce25c4b7c8dfa92442290b87bd496106830e031f9a846a0627
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsi5:BbdDmjr+OtEvwDpjM8Y
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_0013d56be2b2d920b95fbaef11a3db82_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_0013d56be2b2d920b95fbaef11a3db82_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5c75ab6e2f3f33021418f1b9750eb84b1
SHA1acd0422d110abaa58c3b16d42948afc6fb77bbbb
SHA256304a4548bc5f368b498cd74c401b664915f9962d2c22e21484ac51f5fd5a8e73
SHA512024df1d7a2a6cbfe4e04729acfc4f4ca892c7d7ddf5da63541ea001282d03e82cc38e27040e1122de316921704d0d58a2aa8bd9e7e8a9393b916642ae2d3d278
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB