Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
23-04-2024 15:39
General
-
Target
2024-04-23_d4924add5278b72ad7f1362e419536ad_cryptolocker.exe
-
Size
49KB
-
MD5
d4924add5278b72ad7f1362e419536ad
-
SHA1
485f34c9b0e3fbc64a943fea3549a46f0da839bd
-
SHA256
23ccdb29e47e6bcc7d57f4b5727e9aa7c1fe54b9333370ca7a3363f1a0eecbd2
-
SHA512
70b6bf4df405527a62afa8cc410a81d0b91a34153de20b53405f9f81c8df3430fae9b6edd69f98e26c0e8781e7e7bf9076d03f884d4f3711552cd0521c9d8c18
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2Moccx:qmbhXDmjr5MOtEvwDpj5cDtKkQZQn
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_d4924add5278b72ad7f1362e419536ad_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_d4924add5278b72ad7f1362e419536ad_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD52cb99a22b5c6ea0ea8684529a626bb5b
SHA1316c6f2f40aa5bf4bc4d162d8b869efe71c8342b
SHA2568a1ac70478e99063406493694868116245b1aa11ca7980b8aac7d8cb952eabbd
SHA5129dc40d419e9872ed545cb0f82ac10764324eb00edd71c90a2537faed9ba4592ccf58eebf7e4f362d43e6693481f0946d2001d1feb2c3d5118a29c45200c9d5ac
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB