Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23-05-2024 00:34
General
-
Target
2024-05-23_48ddf213be040e5c67c1232b5751eafd_cryptolocker.exe
-
Size
48KB
-
MD5
48ddf213be040e5c67c1232b5751eafd
-
SHA1
bdb57d0e229b22ed50329a42c49cc8ab92c450b8
-
SHA256
f6ccd4abf53500b30c7a8a74ec05c83cc30556bbc5743cfe2857ad9c205c8694
-
SHA512
53f79c1b4b8043b527abdf21fb5a6135174adf1acceb18f93934cde02bb5b2175a85f6049ca9b8d10019dc468ed1d4e11bbc06087c221d258675dc998a7fdc2d
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkcH:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_48ddf213be040e5c67c1232b5751eafd_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_48ddf213be040e5c67c1232b5751eafd_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5d06480bab24bf019ca7420d43c81a525
SHA122b7e586e7be25d4412f1826598b747d3cd482ef
SHA256e0db56bb8492b53f338cd8c4531ce095364e5368fbe82177ca4ce85342b0d490
SHA5127ea9a5ecded998147559d16021c95adc4bd49489d10c7322603a342ab497e4a9c7a7cf13478e016fcf37decd9fe77b9cc08cbe3bcbb36d10f2adf354dceced64
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB