Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
27-04-2024 17:31
General
-
Target
2024-04-27_930fa7246c2360e2aa2612a81daa054b_cryptolocker.exe
-
Size
45KB
-
MD5
930fa7246c2360e2aa2612a81daa054b
-
SHA1
93ab0093c7d1882f456f5ae33143853f7aef3e4f
-
SHA256
fe8718c34b966a3f666b4f81a3f300c1a76ecb39a83c9c37f3fdcc5712a3a988
-
SHA512
95ac257a441e44dd4be8c1b7a3830cd41298190b7d385366a661917ff2f10f600d39110d821934c253aceb1176e1f16e075a29418405b043b53a492ceae84a89
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPx:P6QFElP6k+MRQMOtEvwDpjBQpVX4
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_930fa7246c2360e2aa2612a81daa054b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_930fa7246c2360e2aa2612a81daa054b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5678ad1ec3197d35d4f243da8565c49d6
SHA149491b6576bbc942a305a2b4f4bcde11e7c6436a
SHA2565d6186b7ad58a5cee57a38fa036508f01458593127bfa4f9d050ab04606de705
SHA51201d736894d393344edfa8f13a8249f457dd083b29189cab78f84db787edc4ccfef200aee0ea436ff812ac2aa2202efce88ac8133a1523480c9680209e6384a6e
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB