Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05/04/2024, 03:54
General
-
Target
2024-04-05_89cf91491d305781555592d4f68228a8_cryptolocker.exe
-
Size
50KB
-
MD5
89cf91491d305781555592d4f68228a8
-
SHA1
cfcba9f8b58dab0f12df116f547634b29353a55f
-
SHA256
c50ea0625f9356f49d17ef48b01a14828b1630233267b8de0d1e3e8c21608e45
-
SHA512
5acc4b1210bb74c614f23f409894ad5af1785a30a2776f4144a0f57de728b0861c4681d8601fcbadaab8d357ba4b912b9d6b4a89b50d528f43d662af703edd7b
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qn8pKIRa9:79mqyNhQMOtEvwDpjBxe8TpXRu
Malware Config
Signatures
-
Detection of CryptoLocker Variants 3 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_89cf91491d305781555592d4f68228a8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_89cf91491d305781555592d4f68228a8_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD55dbe627cd815592e69b487634a61daf4
SHA1ff5de99a5f8b0301540a3db2d74aab0094fd0861
SHA256f8921e6bc1aedcb10e75410a89718181468c6b08ffcb7fe7cab5a9d0c868ff4c
SHA5128d81ca60426842e530792e266daf10ba6d42c5a7d118b79db87a8d847fcff5cc9b27bd4555b582311d1ce72a7bdf1bf58a7ac29b5fe479677bb4cb8ddacb9fde
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB