Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
30/04/2024, 22:31
General
-
Target
2024-04-30_7e570e863c801a62934fdb390665b0ac_cryptolocker.exe
-
Size
47KB
-
MD5
7e570e863c801a62934fdb390665b0ac
-
SHA1
7447a6925748b321dcbbcd576fc9c40f2c2ac2fd
-
SHA256
15ebdc4334950ada60c4daec478b082d974a209ff9a19512d8e0c59654bdd46c
-
SHA512
f805116916a21527030b0cb6a3f7019849d54c8b9de9474dfea5c20c6fee93ec3cf5c1392c21b43a5b4990e9017fbc48bd01b9594a67933e2208e1a02edc79f7
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkcb:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_7e570e863c801a62934fdb390665b0ac_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_7e570e863c801a62934fdb390665b0ac_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD507d77b2a1379daaeb68b64fa73636de5
SHA1ac5ccb30507fd7b128aee2de67431c875865c55f
SHA2564fe0b003f04dd66e9288a1b45c37401e7db35c2f0ec7e1727a1560ac274234bc
SHA51232576a9a4c9494ee34a96c33a277bca13c84a03ef7812582822a0a1f3982dc7d0ab82690e8dab83350d91b3527901bee9f9fede5172e5d3a091f38e5e97f9476
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB