Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
31-05-2024 07:43
General
-
Target
2024-05-31_896135e0f510fbc44c34b347d14a2fb3_cryptolocker.exe
-
Size
42KB
-
MD5
896135e0f510fbc44c34b347d14a2fb3
-
SHA1
d2c0ba14c04b280000108c96471ec31c305470d2
-
SHA256
666a4094150daab3097d4e19f636031f407205de2af4e23eb0b4d06e4aec8119
-
SHA512
39935ccf3e40de229e050384c8e27bf98d3dc4dde37d49ff000cf3840e705f4b2a63d9ae57af0212cd4826d82bb23a45a483d3a99bd73b64cfb7644171f49ab6
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vF1A:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLE
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_896135e0f510fbc44c34b347d14a2fb3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_896135e0f510fbc44c34b347d14a2fb3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD58e0d6e4abc9c18e0521014898effb6d3
SHA181f1340b9c9dfb28a50c71f52e29725fd30d52bd
SHA256433fd02cd28af50fc229a98cf6dc9f1413f554655263300c1ad1a59dfcba03a6
SHA5126371cb43f1024381f9956e3516e441e13626cdca332acb8ef98799f4a141af041fb9a2ca806f4c765e33ed02a71682ad44f8d40626aba127af1aa5b4246d3ae3
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB