Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
07/05/2024, 07:24
General
-
Target
2024-05-07_2a24cc465fb285aa7712c0c171309013_cryptolocker.exe
-
Size
51KB
-
MD5
2a24cc465fb285aa7712c0c171309013
-
SHA1
b9583b882e98879d91bb8a136e32cbb885c0f51e
-
SHA256
d18a8d43787d6b3ca08c2f8ba6b5d4a6a7a191f6cf7720457d16356ef952d18d
-
SHA512
c3249b251f6e3494ed1a61c063c92bd5738235653be9e6bd80a99dcfe70bdfb0dc8abaad32a7739ffa6a5686af6bd691e3beb80f89056b84ace374c31ef406af
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoccS:qmbhXDmjr5MOtEvwDpj5cDtKkQZQzc
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-07_2a24cc465fb285aa7712c0c171309013_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-07_2a24cc465fb285aa7712c0c171309013_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD543440458b14c1b0765b16187bac86898
SHA1a7ab2b45196d75d618de75ccd3106b84353aca93
SHA2569df7dc91b742bc260fa08409e020d135bdbabac9e61f91aace7406db26862dae
SHA512e70e2d440c61d9f97a7d4d8edf2c6578a9f7c139d3f19ac29dea3daff5eb5e437f3f53ca7566b7d2a2b9596e8d9fa1b2024956cff89a05eb1a29f82e1aecce32
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB