Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
29-04-2024 15:48
General
-
Target
2024-04-29_19eae9bf046bdcbb6646d0891dcde0c5_cryptolocker.exe
-
Size
45KB
-
MD5
19eae9bf046bdcbb6646d0891dcde0c5
-
SHA1
9577ae0570f969be3d72e4fa4cbcaddb6537b464
-
SHA256
ae1cd1714bd1db6099e47784dfc35ae297a19d8451b36f9c67b19347dbd3a8ce
-
SHA512
656a4b30b169679e4087193a515fe9d869b54d3544e79f723a8b10b8339e1b3a508b7e3dabcd0ceed19435a28209f841eb2d4b46aa173cec07cdc9d96268fd30
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPoQ:P6QFElP6k+MRQMOtEvwDpjBQpVXzQ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_19eae9bf046bdcbb6646d0891dcde0c5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_19eae9bf046bdcbb6646d0891dcde0c5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5e2504ece4ddf139d78f89f099ab5f612
SHA11bd648f0ba26cc1ac2f40b702be8c5de1bc3324b
SHA256a5a33234e12c7ae1831ad93881050bc9e7758b79e499a64456700759c1e3418f
SHA5121d9187b66b93c7ce7efc3d95c09cf3195980a1d99c268a8909ce4975dbcc2602f25e724863c915c2a101d5f7dc4f7d6547b0760b8ebde8dd5c9b00224c473959
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB