Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20/04/2024, 05:37
General
-
Target
2024-04-20_853c297d1f9bdbd801e8ccdabe176ab1_cryptolocker.exe
-
Size
40KB
-
MD5
853c297d1f9bdbd801e8ccdabe176ab1
-
SHA1
588de0363185eb54de93586088f194d004ffa7a6
-
SHA256
2d51a6d50b7e0f11de0e980e7c0d2cf053eb004dcf8a7acb32b2fcb39317a090
-
SHA512
60ba934d7778c8e5de778592b80562ec709173a23323086cb34201e77cff9598a759a597068ebd8c76fd9c3754596e359735305b4a49339d714c475912d5df63
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vFHw:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLa
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_853c297d1f9bdbd801e8ccdabe176ab1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_853c297d1f9bdbd801e8ccdabe176ab1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5ccbdafa2c50bad6017393a33df5c273b
SHA1fa7d1b756ded2c373b8d80472eaafa2ae3f4e128
SHA2566773be79c32f39f742de4601c5c1c28114c3050f11a75cd3c330ba958ff5df5e
SHA512e0431c78ca416c05b52dcfb550a1efd9986b463875894fc5974e5b0cea619e305eef8e0ad9c7b6c71f1eb15550cae41c16b29428a07126bced6da802c46ae805
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB