Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 17:43
General
-
Target
2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe
-
Size
36KB
-
MD5
2441cba914fdde916ae4be2cf9d95207
-
SHA1
5e69b7da24ce7ed9e2998954ac036556863590ab
-
SHA256
7c1b54c779bae89181ffca2fa3cef74e9cf19bf4b24b659376ee363a315b7990
-
SHA512
95498ac7fc254c9f04eab7e44a65e20ee0d053c459d4eb9af1e3d2377072b19878780ec3bb9403ddd8544e6f86a6f776e81f28e9852469867df24d080afd2feb
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkCuU:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkq
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Detection of CryptoLocker Variants 3 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD55be6551569e68f0649cf0dc356886a33
SHA149c98ddf631730a92ff8c78b9e8ffa86d3fce8e4
SHA2561044672623ac90004bf1fbf3bd534cc76931f67e081928ab89aa67e4ad965d12
SHA5129c4d6b5e84f8a24938bb2b875dd29997a9770ac89c09a63cf3eabbe44bad623e04d126b9dd0411cef8034c93698f0d9a15564695cf740c0a337b72c089aa5ab1
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB