Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
30/04/2024, 19:24
General
-
Target
2024-04-30_3d90efc626726b49ce8cd8e1f69c9dd4_cryptolocker.exe
-
Size
47KB
-
MD5
3d90efc626726b49ce8cd8e1f69c9dd4
-
SHA1
3cdf954fbafdf0ed8f348312817b6384efedf7e8
-
SHA256
39c1586d0e4d0d587a2b3b4ccd21c6b8022696cd16f25a663a7a5dc8deb0d84d
-
SHA512
41c4cac984f331d1764f7d75c4279cc6b159d50a16ba02f2040a8174f7a7a2d1cba415ba8ae47a22fa85113739647a98bcd7c5dde0713191a9ec5208c367afc9
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkc/S:P6Q0ElP6G+gJQMOtEvwDpjB8WMlf/S
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_3d90efc626726b49ce8cd8e1f69c9dd4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_3d90efc626726b49ce8cd8e1f69c9dd4_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD58a1a926a32481002bb2e7a5ee2f6bcd2
SHA10d9dbae786371b300869a3d03446f71f0eda3f74
SHA2562b8043456d7d6334263394f2ccf02cf9be565f43be300498649e71d27ad23919
SHA512c1920aef8550b3309fcaeac79063a642a9960b9723359bc849821dc5c1905a1b884ddb1004ac3e20ac2b8091bedf6369549fbf64822b6f184d656ad3a349efd3
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB