Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10-04-2024 13:26
General
-
Target
2024-04-10_225ca156e2848d2b2f1354ab6c5c8f55_cryptolocker.exe
-
Size
46KB
-
MD5
225ca156e2848d2b2f1354ab6c5c8f55
-
SHA1
765a5fa768930bdc45748c2f21b3f553ad58cf84
-
SHA256
043e52c7d4917523e6634bd1ef6943902fd498c33d0bff518006abd95ae73c53
-
SHA512
eee1054e7507122c52ee49ccf6acd7aa61de6e0466b421ba112dee9e2afa50d0d58e2f47b75a40e7e97c7b20d7aa10afaac7eaf9dedb097d04e6ffca224a12ba
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkcB:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfB
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_225ca156e2848d2b2f1354ab6c5c8f55_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_225ca156e2848d2b2f1354ab6c5c8f55_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD54d396e1e90797818b23fca5449be40ca
SHA12699bc79fbf154bf7461afe943ae3960acc9c8de
SHA256f3ffd09565144980ad41f2b5869ae4564c4493494cd567ae3974c7766e81a106
SHA51204e0cdc32bd41d93f5a07fa196bee7e09958d0d178690a805f13d8eb9c17b10da93731108e950baaddf48d7f35978c77ae16952ebffb524547d8d74185e4b425
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB