Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 19:29
General
-
Target
2024-05-21_5b0f4a79799602a69eb720178311bdd8_cryptolocker.exe
-
Size
43KB
-
MD5
5b0f4a79799602a69eb720178311bdd8
-
SHA1
4dc35e7c597a625c063a026e6566f9cbc305d9ef
-
SHA256
cbee76d036cd52f2ed0cc313f81f071d9f3aa29c7e0b7e95999eb9f2762e026f
-
SHA512
e4de43d6c6bf1ee25195307e566f78e4204ea206f6fa0d302373a5f72c404231f83d0e3c51e0613571498cbbf8c9ac526fdf31cef9cc670f59353896ed832cdc
-
SSDEEP
768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAIie0m:bCDOw9aMDooc+vAlS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_5b0f4a79799602a69eb720178311bdd8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_5b0f4a79799602a69eb720178311bdd8_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD537ada9b2f8d988358c7210b6d0fd69e5
SHA19aef232fcabe32724530f24b605564d88713e7eb
SHA256c5fe20b9c26da88e50dda227d98a2a82b3f7606547797f3727109c7a2a08ae6a
SHA51291bc0299070635f4c378d8cf2398c7d7032822830db28461cc5ee01ff6ce72473acc5fa065d1c1bdc215f5416ad913926c3a864cd21383eaa5c6ac5007b7f8be
-
Filesize
40KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
40KB