Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
31/05/2024, 19:04
General
-
Target
2024-05-31_5a664abf391c3388c1c4b9f9d71f4eed_cryptolocker.exe
-
Size
57KB
-
MD5
5a664abf391c3388c1c4b9f9d71f4eed
-
SHA1
8ac8f5b167302efe8aa1a97d0c5280b5873cf423
-
SHA256
5a4c8506e16e6e749ec3be33a74f7162b84ff6611304a8f73f7925999ea0885b
-
SHA512
3de065f3c7bedb2367fc07ba0632d8782d174bde1cb3510d92126b3d3d4b1f8d435b05a95c01fa2b570c056eaf2e296c25b85c543299461713591ede07d4c307
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6ImpyZ:BbdDmjr+OtEvwDpjM2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_5a664abf391c3388c1c4b9f9d71f4eed_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_5a664abf391c3388c1c4b9f9d71f4eed_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5ebfb72abe5e55bc998ce8006938e111f
SHA15b2eedd7bf980ac87ce2bb4fbbde93a8c3979d1e
SHA2560ca26801bc32b1d618964daef84feb92b82462bcf59ec8ce01e82eb6f4219560
SHA512a11542a812de87d429891ee0161777a816e82872a8b15b8eb198a20364e9df1a71b5becc2af0e15ee6a6d0df52a897cab5efd900e58fcf486337ea585b1cf71b
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB