Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
06/06/2024, 00:16
General
-
Target
2024-06-05_179684274d05de2ace951afea41a04f5_cryptolocker.exe
-
Size
48KB
-
MD5
179684274d05de2ace951afea41a04f5
-
SHA1
9bcec24e83b0cb29a5c9f9a34db208815d22a7a8
-
SHA256
af80072fdd542cf04467282434a80d7b3f67f5a85008cec989c5168bcc988c1e
-
SHA512
d31e6db4b0d7e6072bdc38e7ef579fcfabea4901a650ca894f4add981d313ae827d2c5c967e5972e0912a2a36f5c9b47a0bf5ae7b4eb41e99cc60b75af62fee1
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkcC:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfC
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_179684274d05de2ace951afea41a04f5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_179684274d05de2ace951afea41a04f5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5c65dba27dd59c4cf10ce5d296d295dcc
SHA16080005d8e68f2c8867e45a6707728f3ab226ab0
SHA256dc2e09b7336b1b0b33e772a240d453acfedfe5090c1b07ae895e1b0dd591566a
SHA512a7e8517061f4d16d5d77a1fa461af344d4711b8075f3cf7d200f7a187fb780965d238b5ef4af69a1b2c7bf6d7a3dcd4dfcbfe5ab3bc52cd4f34f29d2f449bb8a
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB