Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28/04/2024, 15:39
General
-
Target
2024-04-28_9815b6e5b0c8c26d408d6f3712d5d862_cryptolocker.exe
-
Size
39KB
-
MD5
9815b6e5b0c8c26d408d6f3712d5d862
-
SHA1
83df0592c6376efc836783bda09a4340087ab740
-
SHA256
e693939c4740fc63e7a97c2dc2aef57a33c398fc59b40a5aabcccab82d6d921d
-
SHA512
ae3e6e5d83c66355dca8e3d63151d4d8290889b0ef1affbe56866dfbe3774cdabc92bb21314994a3bb43d57b73e7cce7d9ed783481562ecd09cdf2af9246822d
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLNWR:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLg
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_9815b6e5b0c8c26d408d6f3712d5d862_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_9815b6e5b0c8c26d408d6f3712d5d862_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5afe817644fc0358d174b2d15d97d2aa8
SHA1f7f586e00dcbc270629a15bfc9bcd868ca95fccd
SHA2560fef5011be404ad6b7ca8c7c3cedb6912af1dec36284aca0d56e6b6d3da0e31a
SHA512e9b2558ed729ee194797b431b96dab1f3b35e4c7489b60a80814a891238b5984e8d7552570ae339b7ebdef0fc77e5c277e4e27e27eba9b15520b04c0dedbb668
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB