Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
29/05/2024, 03:25
General
-
Target
2024-05-29_48a6ccde8f77a6f050498ec9b212dfe6_cryptolocker.exe
-
Size
47KB
-
MD5
48a6ccde8f77a6f050498ec9b212dfe6
-
SHA1
faff775e878eed9f304315ae8af90363b61a2f50
-
SHA256
799befd01fb1d6e74186d6c7bc256dd392b09ee6ec3246c418076f8cd127ad85
-
SHA512
c008a868e273dcd6b539fbdedd033a1fe36dc5c28c1febed51017e5b48d58a6511b67d788eb4958592ba4605454d28da1ea36dd184b7166c601bc6ed4a37dbc5
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPcX:P6QFElP6k+MRQMOtEvwDpjBQpVX3
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_48a6ccde8f77a6f050498ec9b212dfe6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_48a6ccde8f77a6f050498ec9b212dfe6_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD545786e3d3e830dde4d7f6c224a2a7d34
SHA13a0c3addf61d2be738408343f915f81808961638
SHA256cc63fccf04710336a4be43b7e51054087dd49c742ef7eeaf2c01372f7454d1e7
SHA51287e5b25d7b4daa96766b169401b8751e2432c0f50b437fd21547542ecd79df755f5fb686c1d00bd64df51a9f9527a4c8e50af5d86ece18b4ecf2aaa669b065b5
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB