Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
19/04/2024, 00:44
General
-
Target
2024-04-19_e5dd3755bb0702f268347d344ac6e12d_cryptolocker.exe
-
Size
41KB
-
MD5
e5dd3755bb0702f268347d344ac6e12d
-
SHA1
0ee7d04548e166a92f938ee7264b6b0baaeebf15
-
SHA256
30e1fbbd183b8e7eb3183e7dbfd7430b27496300f11be01929b34c16674f2316
-
SHA512
d849c84e88c0e39d81a5ff0068f6ca0eba47dbd5027f8dbb4971ce3b4b1645f06c9d5fe4e50a1343d365470da7b3e4e920b5900568c5cc87a0e789168bf55dd6
-
SSDEEP
768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAH+:bCDOw9aMDooc+vAe
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_e5dd3755bb0702f268347d344ac6e12d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_e5dd3755bb0702f268347d344ac6e12d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD56d664aaaa1a88b313734a6fbd85a6f53
SHA13b7eead9bb5f51c41576cb615fe68633a0aa27b3
SHA25627327f1d514d46cd5db84fdb964c15899aaac82cd2fbbf8b2868fb37296101b0
SHA51270ebba10fe6deab4b48900bd4c4105ddad8513123700c4da6b58f5f7515cb815e34dd8d820df377e5c3c50f9934aa1542db1ca444f82378bd47aa673dab9dff6
-
Filesize
40KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
40KB