Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 00:45
General
-
Target
2024-05-23_aad4a88c8aeb9f7b8ed9bc07538eba37_cryptolocker.exe
-
Size
64KB
-
MD5
aad4a88c8aeb9f7b8ed9bc07538eba37
-
SHA1
5e875e578c2e4389cc218c990fd1678b58f61d1d
-
SHA256
3a2d54a2ee7740c04c1e5c4ce7d225ce70365dee737575fa932746bf34ea23c4
-
SHA512
63e248486d8b0cea198ed8ab17aecb1a965440d8cda278379c09acc585cbc67df588838bc529724e3c023422a176a6d6dba0f2b8110018ab5f9aef9e394af185
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsih:BbdDmjr+OtEvwDpjM8Q
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_aad4a88c8aeb9f7b8ed9bc07538eba37_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_aad4a88c8aeb9f7b8ed9bc07538eba37_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD530b878db4cb9c0dd10020862da157ab1
SHA1a1929d73df73c3e65571a0ff091379d3fb48a0bf
SHA2562bac15dc3971162d4468f4d97b2810e585077c4bda3163ece3a19eb4bd225e51
SHA512b8e7499aebf4238b5f9bb5a7bc3aa663a7b328dad8ee2158c0f24bc7ca4a43283990142d05bf1865b8f97aa813f6515f4f726ccdbd20d08c6eb449a56cb4b98c
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB