Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/04/2024, 02:00
General
-
Target
2024-04-11_e6e98e563e2d27025ac41b41b1183f5a_cryptolocker.exe
-
Size
64KB
-
MD5
e6e98e563e2d27025ac41b41b1183f5a
-
SHA1
b1d2b331cc5a0302c51dd5356e50f812912381ab
-
SHA256
ffe61bc6e95478b8724244566022fe19166511c4e14c4b1393655e0c1eccdab9
-
SHA512
bb9a87ba570fd9ef81c8810b04049f6456f08bdefae9f0ab193c57d307c4f383eeccffe9e310e5c2653d4c506eadba778a8dbc6844f756be17aea33c4274d661
-
SSDEEP
1536:V6QFElP6n+gMQMOtEvwDpjyaLccVCbmh85r:V6a+pOtEvwDpjvs
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_e6e98e563e2d27025ac41b41b1183f5a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_e6e98e563e2d27025ac41b41b1183f5a_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD55d87ac7e52c67a4f02737ee4326293b1
SHA17160fb4ed9d532b14667fb3d90fef74711435ce6
SHA256693793d37b3e8a7030f686761608fe85cc80a3d8e12944fd730ada13d7eba931
SHA5129a3b59792e8cd0e76d38fdeff5c98015a7ac1547f5579ecb3f9e29e86ed53317ef2965ab5982d9f248a12cedffbeda7e759e8050560ab192fc26bfd5c91ed2e8
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB