Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
16-04-2024 04:33
General
-
Target
2024-04-16_1cc3fca656b359df250af5eea3ddd0b0_cryptolocker.exe
-
Size
44KB
-
MD5
1cc3fca656b359df250af5eea3ddd0b0
-
SHA1
6340b059c8c7da69f764eb4cbbb8aad90f1f3c16
-
SHA256
63065f9fbf7b6b0432c352baebbdab3c9d22301b0037692ae5cb7865008005be
-
SHA512
07c068132d52ce649cbdef8da0d91c60dbc8aecc6a5dc7cb8c7c3c40cc807bafc9cf0daad20bc1958d136bde37b29a21b13d9566df01cfcfbd2bf11b5ab33053
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedmhqFkvv:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+C
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_1cc3fca656b359df250af5eea3ddd0b0_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_1cc3fca656b359df250af5eea3ddd0b0_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5fd9166b7c788ced4315effc1ebb30c14
SHA1eeb4344906c8459fdbceb49953428bbc980a83b2
SHA256e583aea257c7b25ee3620407e2b53ba043717ad01cf4b6399855b02a01736773
SHA51256df2b0f8c7bd6f1ff6cdcdd9e5b26b33797b055f62c16f1b9f15d7c29d2c223797639c941027e1935826420de8093f39d15f897b81474ffd7c9bb6cdd31ad57
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB