Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
12-05-2024 04:49
General
-
Target
2024-05-12_ef612b0b815b1ca4ec7e5bb913ad5628_cryptolocker.exe
-
Size
41KB
-
MD5
ef612b0b815b1ca4ec7e5bb913ad5628
-
SHA1
9b2a13f3302a32dad7a2591f60eb36381740c742
-
SHA256
ae432461c5f0ec0dd6c0b6ea377db17e8b76cde2f3562821141581254a2e1095
-
SHA512
0cb9a37e544060080c6790c9d603c65a749bfc3aa786e3ad29c9180afe0d32065f656732220a7954df46bab7ae0dc2f29f84e4187791bf2e54ccfb582dfaac8d
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vFG:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLE
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_ef612b0b815b1ca4ec7e5bb913ad5628_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_ef612b0b815b1ca4ec7e5bb913ad5628_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5d400b815dfa01733e6662963f89b49a5
SHA1b0de8ca4ac8d1199cd8c37ef249192890181019e
SHA256195ae7a8ff96bf5b802639a3855db68adb8b08738f1336fd75093b1f23858719
SHA51251313bae21e66d48bb1e8f6f2cdaa463150b9e3e56b9d5a686d2b368ba2c3db2721abdba969e94a68ba4c31cab413b25ad00335bb85c941d339e6ddb5006b55f
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB