Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
04/06/2024, 05:44
General
-
Target
2024-06-04_98445f5a644e66abbf5c5a5fd419b4b7_cryptolocker.exe
-
Size
65KB
-
MD5
98445f5a644e66abbf5c5a5fd419b4b7
-
SHA1
97b45ae04c796752f7a3960b684d6a3d4300d456
-
SHA256
a31e9a0df701fcc85391156a319665fe3e8a755e40465a862506e60ecd038c3d
-
SHA512
8a55554f9af129e87e6bec85fcfc77e47ffa6268d7ebf0c6924b9cce1c3d37b36b6b526f1d5f15f5951f6591f9e4ce0be9604d888aa4dabfd6b7c6afbc1f1df4
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsijo:BbdDmjr+OtEvwDpjM8t
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_98445f5a644e66abbf5c5a5fd419b4b7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_98445f5a644e66abbf5c5a5fd419b4b7_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5f42d87e7d9f582a6e6f5acdda7738850
SHA1400f16b449ff6ed3ac00714e56ad849b4cb197a3
SHA256403a52657df79f1fba06784b8a63dc4d7961e1260849942d7f3fc6bb9405ddab
SHA5127221d235b747320fd46aebcc04a243460611aa96c92eaad6d44f952970840efff66a53cbb188de6cd9f8f4c00369757fef559b927e80d65982c9fc6dd2439afa
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB