Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
11/05/2024, 00:34
General
-
Target
2024-05-11_c830b7bd4c0a7e40d5fcd23ec2fb6cef_cryptolocker.exe
-
Size
63KB
-
MD5
c830b7bd4c0a7e40d5fcd23ec2fb6cef
-
SHA1
96c94b3278ea80488cdf9ff4b12c88123cd2c355
-
SHA256
170b8aac55c4b586d570b01f116dc36224f8246d5c1e896b2cdce330ec81619b
-
SHA512
5b406ed4a3a2e79a29302fbe35b4623add90308ca66bd06fd79135f903701a58b447fc2e46a023fbcac89362f338a97fb85a5346104774aef2069765f2f5db08
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsi+:BbdDmjr+OtEvwDpjM8z
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_c830b7bd4c0a7e40d5fcd23ec2fb6cef_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_c830b7bd4c0a7e40d5fcd23ec2fb6cef_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5ff41011ac64c7bc2a8a793939d713aa4
SHA19d8d3d1eca4a770706d0b9dc6a3e731c0eedefd1
SHA2565a9176fe7bf875d5175983a24753a94ac7c62f643e25d426d932828737936dff
SHA51255b1325a65d32f323d84fa2dd157fc7afcde8d101d60538192877cb9fddcc642c2fcacdc644ec2b654352c800f7d4ac0149cb40f0d8c64b8d3fe15e273e23dc9
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB