Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
27/04/2024, 09:44
General
-
Target
2024-04-27_f49eb63ad1abb57eae0801bac74fd7d4_cryptolocker.exe
-
Size
63KB
-
MD5
f49eb63ad1abb57eae0801bac74fd7d4
-
SHA1
83dbcf3b8931d6db181a96a1c53bc37ffcc93233
-
SHA256
5e970895ff4023aec7f9bcdd3806e8035fb6797a96ab88ab051f23c47147d6be
-
SHA512
a8639427f8a811b0aa0e1afc69bb6bcc8f1d9f520ddb0c566e82c01f637781b6ae4ce6c50f214f3c049cd6bfe6fca090322364f9bc95eb94970bfd92fcc3cd20
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsiE:BbdDmjr+OtEvwDpjM89
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_f49eb63ad1abb57eae0801bac74fd7d4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_f49eb63ad1abb57eae0801bac74fd7d4_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5d327714067aa05045567a5f97d780b08
SHA12f95d65e46a767c94c3abd505c47ac041ffd7f89
SHA2564a51c2caa5af4fe8d8a79f2b73652872a13fa963d5a64a6a0f650a5ff23cbcfe
SHA5126e7727b5eaddd33fa4abcad009f70dadf0308968863d2c63f9984ff2fdd9413ac9413bce0512878ac95d1b4e607b49230b97d38b5f8aff7afda30ad3a121ea93
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB