Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
05-05-2024 04:29
General
-
Target
2024-05-05_473d226775fa929f38a4730db2579168_cryptolocker.exe
-
Size
47KB
-
MD5
473d226775fa929f38a4730db2579168
-
SHA1
bd5b82c47c27431bca5cc075615301dbca5b43b7
-
SHA256
d4cdc40b2a05742d47656c00d1fd2262975e0c386dc12be41e05ef68be06441e
-
SHA512
f7f39b0639c5d84b6630a9222a2e7766b95206ae549b25a59521198318be6c432ce8482a66722aa5b915973b92f7eae81b39e4c54960db6b07ad7f9e0569c782
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkcD:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-05_473d226775fa929f38a4730db2579168_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-05_473d226775fa929f38a4730db2579168_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD552afb21910f37ee7cb88dd6ffb54e31a
SHA19e5d3696adbc64ef0f3775e96882d12d0a9c8cd7
SHA2566c88f668103d9c2e29927d22321aba434364479b41afe18043a5497e0e30844a
SHA512eb00bc68f2e538e8d7534b709c857bb6b4fc50028c681a105fe0fa00bcb8c6c1f30871bb457c925031c1ce904e730f75909433e2ea8149731b3023f428d49ca8
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB