Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
23/04/2024, 07:25
General
-
Target
2024-04-23_0ea84bf60698c3f2d5b26f3fc7589d44_cryptolocker.exe
-
Size
46KB
-
MD5
0ea84bf60698c3f2d5b26f3fc7589d44
-
SHA1
353543210c7b58585a0a18aea5af95322f96f42d
-
SHA256
86b819650a5a92892c5e4073fb6de2568a334144ffe37a52b0737f293e1307bf
-
SHA512
423b19cd17445613460569ad33c84d70085a750dc0e113b2cf48231936977e02fff2af194544aabd6721a9be089d5a0a3ae21d42e25a135b7f94a505270055a5
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpk6:P6Q0ElP6G+gJQMOtEvwDpjB8WMll
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_0ea84bf60698c3f2d5b26f3fc7589d44_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_0ea84bf60698c3f2d5b26f3fc7589d44_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5220203ea1b48a1cfd4d2832f9f90f753
SHA1f9703a6a00e92704302b9ec85d92239dd88ae785
SHA25657ad66438706ff61b8573c05b54416eeecf6e8bf5d3b76d01d49aeb0506269ac
SHA5129911a4bc0069b8c7fd565be507231a2a36f8195d2a42004bcaeb65b880839995ea70b0998ba3aa810d47055a8fe8955734384507fa8495a8579f098cee2accb9
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB