Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22/05/2024, 21:27
General
-
Target
2024-05-22_1e301351bfe1b8b8367b9a4a43b57402_cryptolocker.exe
-
Size
52KB
-
MD5
1e301351bfe1b8b8367b9a4a43b57402
-
SHA1
1b1dc40417b97fedfcb81e1faacce69ad89ea8cc
-
SHA256
fa0b0132ea4a75817ac2cd6f6c3cbd9be6ea258b88c9df79f081b6526d8fa67f
-
SHA512
fdae824c42f800afd8a7748dfb05ece441e385c47f7f03af966c582e1cc0c4e9c031ca127d6a09bac3e44f56204ce41e5d0c1fa3533982f290055e64e7b9aa5b
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qnTHGfSAP:79mqyNhQMOtEvwDpjBxe8GGfVP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_1e301351bfe1b8b8367b9a4a43b57402_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_1e301351bfe1b8b8367b9a4a43b57402_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD57acd7e391792a3bdbb0792af9da4fd20
SHA186991a482c892aec6ab7448da6f972d540908506
SHA256a94e78f65ad5142c807ae994bdee80a2a19086b3ffbbb0e6405d65ff5a8524b0
SHA512401df48bad0e6da12ffb2b80cc93471717fcef86c8f900b47f99ee7cb17646d14729a0ab8c03dc5146567408e86e97e07b6b5b74c057f1724e1514bc7f34418d
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB