Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
30/05/2024, 04:01
General
-
Target
2024-05-30_8591c784b2b6b1b5578d1be90af83fb4_cryptolocker.exe
-
Size
47KB
-
MD5
8591c784b2b6b1b5578d1be90af83fb4
-
SHA1
7f37ba9b9214b0246101796e90334725f9309e4f
-
SHA256
597faed8a70a5ada7897f456afeb6ee321ceb7bfc010c1331a0bea0ac9bc2a30
-
SHA512
cbd41a5e739c6d5c23ad2cf2071df405e96a6eb4de93a1a442843561cd23fe38fbdea8a7789d773766ee5c33bd7606d59ccc118941a8500be5cce1db7a1430df
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPcN:P6QFElP6k+MRQMOtEvwDpjBQpVXt
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_8591c784b2b6b1b5578d1be90af83fb4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_8591c784b2b6b1b5578d1be90af83fb4_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5a725dcb6ff5635aa0130545e7911a364
SHA14a688c9dfb77e7710da9cc394d2e01e324e58c6e
SHA256b2a947a7a8361804daa2d6ea155fd974601de3f406ee9a0830f6f426ab1e0cb0
SHA5120e8a6c089abef462a9f227b93add61870c6e478b620ee5e9ca37bb455fbe57c51b83197345be3d66e510c81bcfee07943ff71b343a74fd76a683086d82f1482b
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB