Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
08-06-2024 20:39
General
-
Target
2024-06-08_8190320cb80e82e3578214201fec0368_cryptolocker.exe
-
Size
87KB
-
MD5
8190320cb80e82e3578214201fec0368
-
SHA1
475c3f3435e822764d3b958ecc7626702a5b8ab1
-
SHA256
c36fc885bfc6cd58be2c1a8fdd6d64877420ca9f2ef36b5fe9f864300daf7898
-
SHA512
c933c597189e319fb3158c590e26560e568025bf8e45c265a7488bd8a191ded3d4e8ad64576947277b6a65b0653a2147935f002736475684e87aae3848da9c53
-
SSDEEP
1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNl6a5:V6a+pOtEvwDpjvp9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_8190320cb80e82e3578214201fec0368_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_8190320cb80e82e3578214201fec0368_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5cd14b8a33ea32b17f68a72fc277f79a0
SHA1c31b35096f9dfc53698c9d69a557f90ecb6d3097
SHA2561f1e0b06288f56cab5f71222c2c7ff3c9a22506028b70817bb91bfc2da0d1ded
SHA512b68572f2b2788eae255a50d9e8d9ba2d66e883b8759b507cb0ae0999d6cc063b2c89a893f57da2fa03c3c69282bc51050624d7f4b55c0ec1068b2b538adb7f12
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB