Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27/04/2024, 04:26
General
-
Target
2024-04-27_0f8c708a07867e7a4a5ca51de0633d90_cryptolocker.exe
-
Size
47KB
-
MD5
0f8c708a07867e7a4a5ca51de0633d90
-
SHA1
21e772bc0253dcaae4569d8407ef28bc66ea1b7a
-
SHA256
dac80aa58abadae5bdca162bb8efb551c9476a4140824a3ec76ba19e4d7d04a0
-
SHA512
4213812c432500dcfe8a972cff3057a2b72d473f03b0883a87137ab725b48703d3fe7bc450c8c1a5bd3e49529c81aae1dbdb94e91875b76ff65cac37e536f30a
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBKccJVODvccwDFUzKm:79mqyNhQMOtEvwDpjBzck1Wxm
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_0f8c708a07867e7a4a5ca51de0633d90_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_0f8c708a07867e7a4a5ca51de0633d90_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5dcb6a4f6ab08232e7044d1abad3c36c8
SHA17d8f64d14c2c89e35634e0bdf94ca148b216d2aa
SHA2563f0b38132951b89a9e74c3c62fd5ef9e302e5d2bafdd052b90c89ee51623cf07
SHA512e9f79068cb4f95a92ef79d9ba9e11cb945d202b8bea6502b9a325258bd144cccabaedddef586514365d8545c728b985007d6875f663491b59496870aa9b2a4ab
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB