Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20/05/2024, 19:37
General
-
Target
2024-05-20_75a2e6519abdc25c390c21762e6068b4_cryptolocker.exe
-
Size
46KB
-
MD5
75a2e6519abdc25c390c21762e6068b4
-
SHA1
8ce33389a8c8a358d5ffc78533b23f3c711fb0fe
-
SHA256
22f4b422467dce83bc7682654227f7b3f987f21b71b80f29936c1197558e9218
-
SHA512
5858a31a0a5b2b3d926240fc7ac71dc6bba137fe9758698503af04d9c4c73a1fff978422bfcb186612f64f828c22a8b2d995bea65b7459f1d86f9fee7d5916fe
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPo7e:P6QFElP6k+MRQMOtEvwDpjBQpVXzK
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_75a2e6519abdc25c390c21762e6068b4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_75a2e6519abdc25c390c21762e6068b4_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD51090c49a09b58728d1d48fa4d73204fe
SHA16ad97a64aca5e773f3e5de8b744aef02d2330a58
SHA256ebf050d18cf51786942451e12a769b5c020fd0d80d5979394036929cbbf07b77
SHA512ed68c78c2792493671f77b515e88440d15ec63dfb2bf49755552c09c0f7c55a12a888a51bccd9bacf8b469f58ef9c62d6513a13ab5b8005d83757da7c98b5c4c
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB