Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20-05-2024 17:24
General
-
Target
2024-05-20_2075330ce1ab5a42bfbe98d25452c373_cryptolocker.exe
-
Size
64KB
-
MD5
2075330ce1ab5a42bfbe98d25452c373
-
SHA1
357e8ef9e67b0e56006f6a5e523cce0b4038fa5e
-
SHA256
435b4c4b55696e78cb4d18538c17d5845b5ea3e209160219cbfd68a2a4a53bf2
-
SHA512
9958ab734ebd9e9d20eb994a66726d1184679aaa34a48c0171e10075b0e8c71786b8696c8a8b61fdf591cada10cd098e4a97297c29d99b72718d8f3910ee4c9c
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsiq:BbdDmjr+OtEvwDpjM8X
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_2075330ce1ab5a42bfbe98d25452c373_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_2075330ce1ab5a42bfbe98d25452c373_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5be395ab5acfcb2b126d9cba80258c513
SHA1d6771f7bbeeb50b66f288a67e00d2cf8b8674e86
SHA256651c3e43407056c980f346d5681fbcebc9a3a3d225858b9df7526900c3f2777b
SHA512f7a43b7dc1b674bd66fcb8337fd49bde0ffcfcba59cc9d393d0c605f7cf14ce4f85c4fbd4921776c779f12fc87883525d544e8e3a030f3c1e4f940b5b1a1edfe
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB