Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
20/05/2024, 18:58
General
-
Target
2024-05-20_e52b76a19f5b9be5fd9b4321658b6d8e_cryptolocker.exe
-
Size
47KB
-
MD5
e52b76a19f5b9be5fd9b4321658b6d8e
-
SHA1
3977a8ab708c8974f40148ba4bafbab464672b57
-
SHA256
a74b0bcb4af736f46b287de7e9b0d7531bee10e6e055dac1baca578506387195
-
SHA512
83f23e08119d04e7cb7c1f4eb226796e2a45e9a1d449ff36554f9db8568c3d575ecbab8e7494019f34008e9742283bad3aea286aaff77540ae15fa09ceea3ede
-
SSDEEP
384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/WccJVJwi2B5oCCM8CLW2V4:79inqyNR/QtOOtEvwDpjBKccJVODvy3p
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_e52b76a19f5b9be5fd9b4321658b6d8e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_e52b76a19f5b9be5fd9b4321658b6d8e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5eb0bb1f30b8e6776917ebe4ca039d032
SHA1f0526537770bcecdb32593d31dfeeb226956d418
SHA25631fd9089d648d2151e7a517d5dbcf33278c4cfdf18e29de747f8acfb3c5366e7
SHA5127fea0c5d3b22f4379fb69a6877d63430b6c4fd81dc656420ca89ec764fa77709ed5d2e2270fa0e384bbbd6f4bf84b859b6913dcd8b2d3983a26ef700c0facd63
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB