Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17-04-2024 06:29
General
-
Target
2024-04-17_914323bd940153013d76a4d796d7d111_cryptolocker.exe
-
Size
44KB
-
MD5
914323bd940153013d76a4d796d7d111
-
SHA1
7fa0ba93decd741daa1f0804b9ca882265fbe918
-
SHA256
d4b1d6a4b823117682fb89c76959441e935b6fc5e78b2e802c5045c36cfb0a63
-
SHA512
096ae968c6e4e48c2c61230b49caa8095304a32fd87b21a097df1aea66ab0685d200e754df79d9b98f9c91238dc6d91587091e135097add317088471d4b0cbde
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPg:P6QFElP6k+MRQMOtEvwDpjBQpVX5
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_914323bd940153013d76a4d796d7d111_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_914323bd940153013d76a4d796d7d111_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD580189f0aaefe781a2839caff4a33c3e9
SHA113f0c7ee98ba4a82cdbf3b07e47c8e9157205a8d
SHA256ee8242b980fa40c7d25a8407bea4d94c626579d5c58a56bc7a15622455b204e0
SHA51239a4f1d2df12a58e332892e81c95fcbdc049a6699a46680757223326171e9af5cc25d5d64f16d6efe9b1447adaa69313555f9b4412e3221aa6b299b4f51f4143
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB