Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
27-05-2024 19:15
General
-
Target
2024-05-27_f6300ec9055e6e45e0ab0caee9ca418b_cryptolocker.exe
-
Size
57KB
-
MD5
f6300ec9055e6e45e0ab0caee9ca418b
-
SHA1
77e50138b5559fd88a2f888a7a905b6716651976
-
SHA256
4927f28f2a33ad99f76da7198eb13d7040be3c91b6463e5e083e3f98b6e112b1
-
SHA512
f3103cf3a43d73c72ef751674dd7e93bd6f1680a1ca52e06e47885ea0e2f61fe65a4ab0c8d949cd18b82579f79ceb7e687f98aeaefbdb8fd1206580ea756be06
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6Impyk:BbdDmjr+OtEvwDpjM/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_f6300ec9055e6e45e0ab0caee9ca418b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_f6300ec9055e6e45e0ab0caee9ca418b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD551d59615892c52be644ec7f3fcca2967
SHA158d4d6b50d0109cb62f246003a6e4c5198ca1067
SHA256cd9eb92bc63b1f0dd894f881813ad6a4f188aebb8210552be2e9627408b3be7c
SHA512b8a71907c813df844b3c3f3d2d820d221f7313e384a94170c513f942032f42d8471b526355e77d137ace5a57c9ba790d60ad29903c2de6d4a674cfb42df765f4
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB