Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17-04-2024 03:44
General
-
Target
2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe
-
Size
38KB
-
MD5
599c093fc60f8ebfb2c83d2a8572ceeb
-
SHA1
4273eab410a394ad051fdb4e159b151d4e64b008
-
SHA256
7be442b58f7e3a44a8b40709e9cd8ee1f2ea55e1f6b2e4676baa157bdff38b66
-
SHA512
25646caa75af4d9cd1bafec9b03e98a0a37f1e96f4ade96ef25116078146ba1c93278b5c8d4187f8b11181fc182841f4a048a09e9f90ecaee5b72f02c5090dbb
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLpz:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLN
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5f43e47cb24c5a6a2373498fd4b5029c4
SHA1207363e6fb45fea404ab860ec6db6cb46f29c0fb
SHA25639ef5b8db196b34b60f6e8dbef084d3e49b2202bbed6a36dd23f695da2181df7
SHA5129a2d727b3107c11aa5c90679e84fa490e0abe23d7fa4496d794c986a61a5bfb806e907c4a3ef8e2ac9fc96c6d35f71a183a47e83b5a5a73566d0728308782d98
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB