Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
29-05-2024 23:31
General
-
Target
2024-05-29_83aa3b045e7da1a7911be634a18491df_cryptolocker.exe
-
Size
44KB
-
MD5
83aa3b045e7da1a7911be634a18491df
-
SHA1
c541207982ab3317911a6b5cede2bad3ffac065f
-
SHA256
51f0347d2f56a888b2641e3e960ada8d45073009e34b9ce8e8cea40497fb63a6
-
SHA512
0ec947d8d291234b03e8a50baa712e939fbed232ee159ece9bd599d43494af046fc3e6441c6eb478314ef2693dbe38b3d003c895cafd82d33d0759dcf771d614
-
SSDEEP
768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAIie0E:bCDOw9aMDooc+vAl4
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_83aa3b045e7da1a7911be634a18491df_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_83aa3b045e7da1a7911be634a18491df_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5b2fc8a0bf0d9b525e324184b57573f45
SHA15324a183973d0c13edbec3761762497497abe752
SHA25610c64320407757bd1e49d8cf3361d9c68f49415afeefcfdc5a6e292b960995ae
SHA5127650489479c1f413eb063f7a3fbbc44e06aadebaffb328a6654c588e6511079a367e40585b222886202c0d3ef3bb2ddec22a664737c6406c51870fcfeb8de87f
-
Filesize
40KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
40KB