Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04-06-2024 04:51
General
-
Target
2024-06-04_9b591aa591b5b3297a54a5e216469145_cryptolocker.exe
-
Size
49KB
-
MD5
9b591aa591b5b3297a54a5e216469145
-
SHA1
5b162219c284f0b3996844da2f2e6daa206ef550
-
SHA256
f844fc8c18bc78b2059a9b8e4e8273f05361c7f2fbc265c4640485d91d6a7acd
-
SHA512
29cd2440db21e88c472aec72172ab2cf02f900bedbbbde017e110bd11a23af6171b48ca5694fd6ad86a39cc998dbcf07c1663250fed2ed6655923500fe89ad01
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkcc1a:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_9b591aa591b5b3297a54a5e216469145_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_9b591aa591b5b3297a54a5e216469145_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5a6c96494c513fb1276f475bc25fe4ba6
SHA118462c3de3279f836677477b5ef21b4c3847a9bd
SHA25634e02d2239befb054b6e9ae711d934ec5bac3cf9331aa2b8426aed762a7b6be7
SHA512e6f45df27d5bd8515946f8d490c6f235158a56461bb64c7784aef96b23ed25c6e8e45535124a735b2b770240bc42f69adf6d8f8be9300cb8055df5d8f268abcc
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB