Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 00:40
General
-
Target
2024-05-23_68f3d908a450251f685341a9e9e6718d_cryptolocker.exe
-
Size
48KB
-
MD5
68f3d908a450251f685341a9e9e6718d
-
SHA1
f8a47451e17d3dc59506bb14dcc01f46ae53e559
-
SHA256
3567d68efa3489cf2b66e865ec6140631b925efff6d96825db18adca1cf87ce2
-
SHA512
e27f23d19941e80094980f5b2567db051c1e771ea1cdffeab4a1d88ce20a6c7609b648e80f3b0810af863edadd46362f0db65d27059e795212af4b9daac5048e
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkcf:P6Q0ElP6G+gJQMOtEvwDpjB8WMlff
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_68f3d908a450251f685341a9e9e6718d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_68f3d908a450251f685341a9e9e6718d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD57c8799c52eb959673e261796e1fc3971
SHA166022d671dcf070f4af7bdf30a836a59b4eacde4
SHA2562d60a46b1e8ddb6dabd79c025afebe2bcccd48a5a61ef3b862def34a4db3dc7c
SHA512781af2674fbed69fc08f72b14861e5864790e784f595fa9dd7d36f3791a973266012d33a5207efc1bd310ad567fca6a48f7462d975be71847112d681b37b5a00
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB