Analysis
-
max time kernel
0s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 06:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_0bfc385a9d8c805bafb589ac44a9e816_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-10_0bfc385a9d8c805bafb589ac44a9e816_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-10_0bfc385a9d8c805bafb589ac44a9e816_cryptolocker.exe
-
Size
65KB
-
MD5
0bfc385a9d8c805bafb589ac44a9e816
-
SHA1
607eac61e18d09918b7f53e00c0be18aaaa28feb
-
SHA256
62fc1fb6268f639a8837e91335df61692fc1d5ae0a1d360b05d67695c242bf2d
-
SHA512
18475f0ac59e9ef71b4a6ae1196b1215f800b5606d63bbcc6651b9934d4340e74c4e4a64bb21642c374918f8b32db8b4a988629d8a0d0f7e6c2ffdf67282559f
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsiena:BbdDmjr+OtEvwDpjM8Ta
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral2/memory/3304-19-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral2/memory/2136-17-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral2/files/0x0009000000023387-16.dat CryptoLocker_rule2 behavioral2/memory/3304-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral2/memory/2136-27-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 2 IoCs
resource yara_rule behavioral2/memory/3304-19-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral2/memory/2136-27-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral2/memory/3304-19-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral2/memory/2136-17-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral2/files/0x0009000000023387-16.dat UPX behavioral2/memory/3304-0-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral2/memory/2136-27-0x0000000000500000-0x0000000000510000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 2024-06-10_0bfc385a9d8c805bafb589ac44a9e816_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_0bfc385a9d8c805bafb589ac44a9e816_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_0bfc385a9d8c805bafb589ac44a9e816_cryptolocker.exe"1⤵
- Checks computer location settings
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5af768c4a8b2edc15342eff891154f4f6
SHA1dc788f640da8d2442e894ec00d6732697e903c70
SHA256cd5db6fd421b2dbfb106ee7af91dfea1be8c70c0eda54fe2bc49551154cd8dfb
SHA5123849c63c00c3e0e487d6e9c807ccaaace442db49cd61c69650cea832c43000aa909097d47f4a6280f179a68e555bd5b8970c5ef51a6f92f1daacd678be5dd766