Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21-04-2024 04:29
General
-
Target
2024-04-21_cdee6c5724b19b19537734f012c017f5_cryptolocker.exe
-
Size
38KB
-
MD5
cdee6c5724b19b19537734f012c017f5
-
SHA1
ee24e20e215a11b48718f490715a0802d4ced6fe
-
SHA256
04163c2a15f148678c81d10214d45a9995f283eeb9ddf6d361ca4a84bf1ec2c4
-
SHA512
252e3315740be1473d190929d00a2943be63523b1c069ea05440d7413a9effdec200cdf885c4b31e9c38b5b88947ba6da644806883acdd6291057b39049c6988
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLpw:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkL6
Malware Config
Signatures
-
Detection of CryptoLocker Variants 3 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_cdee6c5724b19b19537734f012c017f5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_cdee6c5724b19b19537734f012c017f5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD53067e1f9601e892a9797bd48d61e2a12
SHA16f8a974d3d72998d1cc5c18246433acf41fa068a
SHA256e277241502a0d8500e0c755369a9baa480e8b74bf3e313ffd7ef511629face21
SHA512ac198aa35ece9541f0cfd711d4a73f669f4f054845d443b89367459cce814a5c162d4ee073bc76c0a6096975b69e746f01af2010c9bfc6f0a102bf02550ce716
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB