Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09-06-2024 05:31
General
-
Target
2024-06-09_4c495f106a7010e240ae020c9d82bb03_cryptolocker.exe
-
Size
69KB
-
MD5
4c495f106a7010e240ae020c9d82bb03
-
SHA1
23ce39cddea6111c3ceb8fc268d102fbc595948e
-
SHA256
8937da958a37f36d36109da0a278f60c4d29cdc88b22f7eaa9fb4e39f8f30a01
-
SHA512
1099279fd7b32d935509cd05e03d293bd2b47ff54f6d9a2a2d7b89b816a4e94cd64872feb0a5f710550814d295910eb0decc796d622cf31241415183efc2ff8a
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUj:DW60sllyWOtEvwDpjwF859
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_4c495f106a7010e240ae020c9d82bb03_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_4c495f106a7010e240ae020c9d82bb03_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5b7a51c17467dbb938aef3dd85ea48f76
SHA199cb96085f46aa5a3d8bdb1c3aa29c3e1f16833c
SHA2569bbb38624355f1e6480b0de04699482757ae4e4015691c9c0038cb90cd99709d
SHA5126d58d46de3173af57d0df10bf11a38f6d55b1ac28aa2a8a5d10cf11460badeb09a63bf67a38ffb204fb69673634a4c01fffb4f0e68d6e4975d292670e78766b6
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB