Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24/05/2024, 07:34
General
-
Target
2024-05-24_74a0c9c6305fff29c88ac7d40a7f8109_cryptolocker.exe
-
Size
47KB
-
MD5
74a0c9c6305fff29c88ac7d40a7f8109
-
SHA1
58bd46e929511347995e1c0ea98899d222c404cd
-
SHA256
fe2426a9e7b5062d174524530d3fb0e5c54f2049b024aa20c1468c57b7f8e185
-
SHA512
7490e8eb568d91582c7e56a37e8d2f375752c96eb205de8b145d9ec6639705e19ff6f0b9cf29787d59a4336297069286cf7839854ed95afe90e28be77aec8d4c
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoAA:qmbhXDmjr5MOtEvwDpj5cDtKkQZQB
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_74a0c9c6305fff29c88ac7d40a7f8109_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_74a0c9c6305fff29c88ac7d40a7f8109_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD54b16018a9f76567aec70eb0d2d51e6ee
SHA194b255027c6898908f290c54c261657a454bdab9
SHA256c23b758a778654ae1235a921a5155af50445c6b66884a29f628219684f646708
SHA5127d3feb60828220c2e16042b3fc0d0fb8f2dd67367a0a3d70fa4808a4c589f0cf124c37ac5c634f018ae7f0c5496644f0335f03bed25cb075cd00d084623daed8
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB