Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21/05/2024, 15:30
General
-
Target
2024-05-21_24da734bb1e69b0948af7dcc8c8167bf_cryptolocker.exe
-
Size
48KB
-
MD5
24da734bb1e69b0948af7dcc8c8167bf
-
SHA1
89b1b2fbe28ff50b60f16de671c39d5bd05d9dc1
-
SHA256
e2c28c83cee03bd3a6454063c990f10f1b679200c21bc5fecbec3fcd555a39cc
-
SHA512
2a96eb26c610d003b8c7e391fc2994bbe38a8837404ece8866c72f93d2a165fd37da35b4cb47992d42b96fee5028713b7ac6b8ccaa79113a2cca9c67303d247b
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkcl2:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfl2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_24da734bb1e69b0948af7dcc8c8167bf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_24da734bb1e69b0948af7dcc8c8167bf_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5ea0d0d8b6b66c96a6378fe0e86ee53eb
SHA1de308c7c777ee731b625adee86ec9836a96933e9
SHA2565248b4148d8cb66c09a8fabdaf1aa4fe79c4ded1ac77a00117475efc5364cb15
SHA51285c9a263f909938370d599117bfe6fd14d4319befccd505d1ecadfb62b496d33633f08ca8db207832dadf7568e461fbdc2c583b2fa6912edaee41809e69a581c
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB