Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
21/05/2024, 05:00
General
-
Target
2024-05-21_757c99300f6ed4a23d0d0facd2087e95_cryptolocker.exe
-
Size
64KB
-
MD5
757c99300f6ed4a23d0d0facd2087e95
-
SHA1
bd7f5b9fa6934ce878bcd3365e0464b77f1154ce
-
SHA256
c8766c8a983f3799590f86391ec043650cf1fd2e0ab80c28caebbe99f41e10d8
-
SHA512
db1e807322adcc6e4075542f543c000905133976112e64f3b662ca0c439227e53ef931942a623b6647cc427d8af586dfc158a0978176f1a2c5e6b1fcfff5c062
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsid:BbdDmjr+OtEvwDpjM8s
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_757c99300f6ed4a23d0d0facd2087e95_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_757c99300f6ed4a23d0d0facd2087e95_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5e95595b94f1a3836714db7c16e60bbe8
SHA1fdbf595792b6d4e08f8d08f46ce62de864d4d173
SHA2567b67dadc8bbcc7bd9c385fb4d3799995fed1575c0d0e0bf82037b539f70febb3
SHA512b04530facdafa551bd9e1693554e044d93c5e52749ad967c92623c19dcb5fd6e80623ef72f65484d53dd5907fb6b565ef2adc1cace24f9fd5eec9fa698b29c9d
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB