Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01-06-2024 19:43
General
-
Target
2024-06-01_eb1bd7d86467a5c2f750ba9216dd373b_cryptolocker.exe
-
Size
74KB
-
MD5
eb1bd7d86467a5c2f750ba9216dd373b
-
SHA1
a1dabea6efaf388d18fccac1d8e21ce28b3a9d5e
-
SHA256
6989d2763c9ce50c34e7586d6ee92bb32587d55821e35a53f1fb91637066c4e4
-
SHA512
f231d28e50479620156e13a93e74801572b703c84c8bf6613a3580c639ff8fb03f9cd40b7073a9194b1400ddbeafa62416c1ec2b5557354b42da67b9f5011667
-
SSDEEP
768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMs63c:u6QFElP6n+gWMOtEvwDpjJGYQbV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_eb1bd7d86467a5c2f750ba9216dd373b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_eb1bd7d86467a5c2f750ba9216dd373b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD5bac6fe84b8fea38f0a100863ed5c1f97
SHA1773a0a6130ed4ecf1d46d6b97d503d0736d2c729
SHA256aa3545c6c951d3fb7cfeb35b2668747d494581769e64af4f45f0c465c86b91e6
SHA512993198deb4294c8d2862fefc56735d2e3740981bbae939e600aa8af34d039b7a297bd7d12738f7a192197214a24acdf03692842bd36dbc0c45cb8fee1b8b339c
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB