Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-01-2024 17:31
General
-
Target
2024-01-25_7a967491d20b799cab6af850c73af3be_cryptolocker.exe
-
Size
51KB
-
MD5
7a967491d20b799cab6af850c73af3be
-
SHA1
325332d1fe41cb467ab9b65b89101e17eff34499
-
SHA256
e1a013601c6b0e33e00e091d7cbf9991103359e81baee1daecb8f77f7a33b3e5
-
SHA512
9573ead97632f2b4dd9f2e2fbe9107d1573c64592c73f1823dcbb787edc123a6a25afd4b0d9db6c7d2e36815287de4c0424252f280b5c0054b412dbdbfaf0954
-
SSDEEP
768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9GZ:bIDOw9a0DwitDZzv
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Detection of CryptoLocker Variants 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_7a967491d20b799cab6af850c73af3be_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_7a967491d20b799cab6af850c73af3be_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5fff6d96feae5a88d4416b9c0c3bf1119
SHA11aa580da457a2c9f0931623a5f58c62b859d0d4d
SHA2569acc9f834d4e8ec30f0d834d4ccd1fb8b3f5e6d4f6c140bed0adde8a74be1e96
SHA51208f44f731bf16b99f6b64e82ef5b2ab68e468a103fb4517229198be82c61de52771816b5cf2f1ef2cab81a57f6cf38b1313f4dc58bda9bca5d80c0f36148c097
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB