Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
05-06-2024 02:25
General
-
Target
2024-06-05_0485e47336ce8622269d5f1296d3e529_cryptolocker.exe
-
Size
49KB
-
MD5
0485e47336ce8622269d5f1296d3e529
-
SHA1
d756ac01b149f5498d16d8bcd07df0fcc13effe1
-
SHA256
d26e5da23623730113b8ec8bd305f47815761c58daef1b8362c2f3778b521db3
-
SHA512
ac99ffa3710569622e97994aa1b4a2e5c210032ff597225b233e7356b3823081776a441d6732b8e32af8df8d4e53b5e8506d2b2f00e4481c37483fb98952e43a
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkch:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfh
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_0485e47336ce8622269d5f1296d3e529_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_0485e47336ce8622269d5f1296d3e529_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD561e94e757ea34bdc2c102cb72797e658
SHA16fcc966dde40783d60718fec1bd5300a1767af3c
SHA256e0db2b56f2be6f3581a8272588e0e27980942a8a9b4e069f55fc315ba45f4c91
SHA5127d35c4363e82a152cdfc6b5d16a4be5ecdb17ae9a1df74abc06c7cd92cb7fdc69c1dffc2230a0dfaa24aae571c955894e120edf845cc6cf33cc3903b7c03853e
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB