Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
21/05/2024, 23:33
General
-
Target
2024-05-21_46d32c9aca888dcb2fb75189b3602b5c_cryptolocker.exe
-
Size
64KB
-
MD5
46d32c9aca888dcb2fb75189b3602b5c
-
SHA1
13fbe861bee987b8b5a21fda7a17a8d44eb4c99a
-
SHA256
a31aa62a37c6bf15aac094dfb0f3dac4e96408a553e81095eae37f6d341a4436
-
SHA512
907f53703aa119621f3179200424e9aeffaad31b60b320e08d4b1b4e326f36cd5e8980ec258427a879a262ab63a08adbeeced3d7e5997852a3bfc74bde86c262
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsii:BbdDmjr+OtEvwDpjM8P
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_46d32c9aca888dcb2fb75189b3602b5c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_46d32c9aca888dcb2fb75189b3602b5c_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5ab1a9767a8ceb09347f63ee0b3579edc
SHA1f9051b2b135a2099cd85f9441408293a034730bd
SHA2561b10c66c65ef5d32c1a18d5255d7fe747d6f31933752732ae6614efa4dd02af6
SHA51218cf201c7bb47b2f90dfeef6c17508eca271d640baf4b09b8bc5ac7a03c9746e890902a758f788640af38a9fdf3af403eab9e8f46dd11b0bc791318998c65ca9
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB