Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12-05-2024 14:37
General
-
Target
2024-05-12_8fcbdc78b725645ea2dd233fbdb1d487_cryptolocker.exe
-
Size
42KB
-
MD5
8fcbdc78b725645ea2dd233fbdb1d487
-
SHA1
7f4fc37a023000a6cc9c7844112cd79c94de3d23
-
SHA256
4dc08a42f2508163c1b23ca983f6ee3aa5dd33f94bb8f01ef563f5c4962e5aa0
-
SHA512
8dd3b8b023d54f9f3ebfe2239ad1c1006dfffb7f1c749c4770d2e1f7224a956803964967301876ecd5fe5ac567f43aa3543103cf1d6781b282297cc5f0007a6e
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vFO:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkL8
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_8fcbdc78b725645ea2dd233fbdb1d487_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_8fcbdc78b725645ea2dd233fbdb1d487_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD53903f2347490837a15a26fdd5d5b7e17
SHA1951effdbd69e1315cf7626bd9ef890e1ab2a69d1
SHA25650d7285cb1cc2497c724a38cfb64747429b51d683fe88b0b00d918116ea8d85b
SHA512fb12c0744176f52ccdfcd3ec6057b77cccc92ada805088a8740913ef15cfcb5767bca10a3be2702e132fdea8304154d5274767d9ee4d4d49c2d3d2f57a6cee7b
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB