Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
28-04-2024 04:38
General
-
Target
2024-04-28_667c2576936bb2c97a750634dd091e8b_cryptolocker.exe
-
Size
55KB
-
MD5
667c2576936bb2c97a750634dd091e8b
-
SHA1
e5df185cbf201de944a03eaa38c97736427a3f25
-
SHA256
c456421ae24e9d95b1be9ab308f7e975da6fd7352592ee9db120e449f775079d
-
SHA512
a42d70cdf317b869ead1d496a8bd010431f5caae0993c6b78ab3f9ae3b89355f760aac167b29077352d18d973a27671a049234eb461b14e50a66e43b322bf3c6
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6ImpyL:BbdDmjr+OtEvwDpjMI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_667c2576936bb2c97a750634dd091e8b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_667c2576936bb2c97a750634dd091e8b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5f81a457d689168201f15b1ae1959efed
SHA1ad635f275a3d3426c21177edafd89a2c71e7c561
SHA2560415076bdd2755af85534d6c448f135c6f58301e32200d64a4c13c90b4ac908d
SHA512fda2b82129baf46c01ffab4ea0f64649b2777c32704759263b2e19d5b3a8ddc1933822d80ee85249d009663794f0bf7a47473726f665c606b378dcff3b747c40
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB