Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24/05/2024, 04:25
General
-
Target
2024-05-24_299a030df7e1996bb72f46d88d919649_cryptolocker.exe
-
Size
47KB
-
MD5
299a030df7e1996bb72f46d88d919649
-
SHA1
fd0c87669ed88d3977c817046e54a8aa54fb8aca
-
SHA256
c29e11fe1b78163f6585e136af5d5e3ba03c17f32dadf42bb81083f12fce08b2
-
SHA512
a608eb509be9a5103820d67ce60cc0e87d0a9614ab9df5be92955d3604a92b8c8e312ab505e5b5b888122408b067af956d2aa7685c7fbd7312f4e63486ba3774
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkcf:P6Q0ElP6G+gJQMOtEvwDpjB8WMlff
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_299a030df7e1996bb72f46d88d919649_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_299a030df7e1996bb72f46d88d919649_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5e7ba63b219d07ef75f19d0108da4e7bf
SHA1ff4395fa8c3237b50b55a4d12c3b4154d74ee76e
SHA2563dfe43f96f39c8ec6e9bc40225614b353152f5383d7d37f3c19f7f16a12832c7
SHA512fdfdb42f85499d01d6f07d1ce2e22b5fc1e996f3919daebad051c0a48de83bae5eac4d029a2b8890fd8d27340bb70dfac9a18491c2fd1a0db7b5631b167a87c4
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB