Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
09-06-2024 03:45
General
-
Target
2024-06-09_703b5e19dc8167b9af572a6e68817d03_cryptolocker.exe
-
Size
65KB
-
MD5
703b5e19dc8167b9af572a6e68817d03
-
SHA1
70d7d92ced0b75cf089d33c12e615a830e503c01
-
SHA256
89ae208172a6c506278aa5d13d99f672e714c3d09d691d35a2c6e6426551e52d
-
SHA512
39aba9479fcfc92f3ac65cd068a5e9a8dbe319272b0d12b1744bb23e272e4debd8684d937c1f26ec9b2dd6de5fb7f520d7a9da8900106e05adc91823387d5fee
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsiI:BbdDmjr+OtEvwDpjM8B
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_703b5e19dc8167b9af572a6e68817d03_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_703b5e19dc8167b9af572a6e68817d03_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD55dbd581de6d01dd29c164219a488ad0b
SHA1062db1343ed7f4b4c3099d78cbc80e8b3c88dd35
SHA256a160a8d5897c831a25231375fe669584fded8f18f6c467349d3602cc25fe5465
SHA512939141be3571db66c348a4fec3d031009adb853c423d5712a6c4040703c4ef27919cb42fd9edd15b5aad73a45cd40e41dceaa89a13943bcd187457c7ff13c6c4
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB