Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
02-06-2024 06:31
General
-
Target
2024-06-02_bc2cc4224bffdced1c5953eda0337da9_cryptolocker.exe
-
Size
42KB
-
MD5
bc2cc4224bffdced1c5953eda0337da9
-
SHA1
6cd93093a5d0ec0a3724bb536d852c32dfa77439
-
SHA256
f7d7aa660f560c13cfab5373256d3faf4c9dd536e43a24df8b6329dbc41bcb1f
-
SHA512
eb8936c4aacd96ec8073709fd3aaab1ae53feb3717d0d56bc626fb5d3342d3b862d17d2f3836d8f75159190a7268b9e07b5e832cb60794ac4d27f13bae44b291
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vF1To:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_bc2cc4224bffdced1c5953eda0337da9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_bc2cc4224bffdced1c5953eda0337da9_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5db5574bf3b288805d452940563fbfc63
SHA16d84c39366680f7f08dda1766afee5fb38685ee3
SHA256ef1fad263fa2b2beb060a0556667259436d0be3d1b81742c1a758123cce7cee3
SHA5123dbd6f32100697f6b79a4d86bc8983f956a02346bb58a19d5752b8d0602393dcb97dc4813a42f1de17fcebe06f71d193bdbc16488a2b6061abb9eed33aa3647d
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB