Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
08-06-2024 23:31
General
-
Target
2024-06-08_b95533c1bede604f8df9e48e96a04812_cryptolocker.exe
-
Size
65KB
-
MD5
b95533c1bede604f8df9e48e96a04812
-
SHA1
33b2b6a9f851a6f6d79b81cab28af14b6e4f6d49
-
SHA256
18b33d3d4351adb75415e8e722ad14358333b4cf0de1d2ace53524b8e232b3b2
-
SHA512
ecab842b7400655a89167f80c9f9ef7056c49c906192f8379b81455a360d62ac8d2898a22635ce9981a3f7e5ed68d2b46734f5bb06e6553f961a787b7f5e94d2
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsig:BbdDmjr+OtEvwDpjM85
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_b95533c1bede604f8df9e48e96a04812_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_b95533c1bede604f8df9e48e96a04812_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5edbbff039ba098da4dcd8b1cb10bf6de
SHA1a78be51266f0d1c4ad88ba6405960e9e6890160e
SHA256a450a9ff3c8701f4403bc361b15bce6cc32c20796ce6045b518c45532d15586a
SHA51203bfbb095adea6f03a98e120c30db2e53b991437285e468b46c57e4864f53e25ee502cec37849f1f6f68e0faf993e2222ccabc9c07e1abb89f0ba62f3c62bd56
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB