Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
13/05/2024, 15:29
General
-
Target
2024-05-13_c962dc56ef1cf0fc96f73133dbcf15cd_cryptolocker.exe
-
Size
46KB
-
MD5
c962dc56ef1cf0fc96f73133dbcf15cd
-
SHA1
66ce3a62dcd2eaa01fe34d1b33c9d3238df5f19b
-
SHA256
e1de5fdc0f34882c50d243f901c4e24bce3cdb91b50907b649b841c244c91c37
-
SHA512
28b35a2bb71e4e090f819fd5ca076102a9811b7bdfc2eb48fa277a527b79683972838f61535be5bfce07308478622c77d1af372f210d39108a2e811a770ab89e
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPoa:P6QFElP6k+MRQMOtEvwDpjBQpVXza
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-13_c962dc56ef1cf0fc96f73133dbcf15cd_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-13_c962dc56ef1cf0fc96f73133dbcf15cd_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD592778301f9cd6bfeb1dacb0a2e4ceec0
SHA150e0e9759419d649bb4210b92332a2096f647cf3
SHA25617c83d2bb0a789bc72653ceaed2067a4ab5beac897858ce6b9d4a822c647649f
SHA512463bf371abfe142507236638c3d0441325deb643c0a32b4e59c7a3164128f44e12621d7aafcd1fc05fa719a2b95e8545ef74b0c8eb29eb2d15e08910e6c1c208
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB