Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08-04-2024 18:45
General
-
Target
2024-04-08_f31d529c6a076f8afd169a33862cd73f_cryptolocker.exe
-
Size
68KB
-
MD5
f31d529c6a076f8afd169a33862cd73f
-
SHA1
9736b65797d6883d2743537a017606de2f6567c5
-
SHA256
5cbf2451275d0465abaa2f5949a2e043b37dc1b9b0061120125e1b377aab59be
-
SHA512
526ec4cb1d66ceb65f9f2981633ebcd9a9559cc829021df9b2701909ba7961713151830d5eac92947f404cb5c318821674dcef16ebd67d378f68d4489f2f6d94
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKU50l:DW60sllyWOtEvwDpjwF85C
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_f31d529c6a076f8afd169a33862cd73f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_f31d529c6a076f8afd169a33862cd73f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD597ed1dab0a62134e3167178e28a7ba49
SHA1ed2d1387ab1aba40853638a6b7f5fd3bfd43ba4a
SHA256ded9f81457b623a5e5d7555152e416688f887084c335c5bdf1eb1bb5c095c113
SHA512ec1c3f437ccb18871ced01deee858e207dded093bf0f3f546a47e3b2a457ca4bc15be7dd202d9663394f04f64f3a7d5764c43179d9fe640dea4bce7a4078d1c4
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB