Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
10/06/2024, 15:22
General
-
Target
2024-06-10_05d92399ef70ecd30ea0a199a61a9a65_cryptolocker.exe
-
Size
48KB
-
MD5
05d92399ef70ecd30ea0a199a61a9a65
-
SHA1
651a99b2f531f8aaf61dd6b8d31646b11801daf3
-
SHA256
62de75ab0d715831c74c96a35e22051121c4bf35e6f13e2f8c2d4bbc5951c8d5
-
SHA512
f21cac8b88332553fbfdb6c75fd792cae691a7926b41450255c89be7f7423aecfd88e1e734915a11075919fca63eaf7a136d4584cc3458d7fbbba1bc900df245
-
SSDEEP
384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/WccJVJwi2B5oCCM8CLW2VR:79inqyNR/QtOOtEvwDpjBKccJVODvy3w
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_05d92399ef70ecd30ea0a199a61a9a65_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_05d92399ef70ecd30ea0a199a61a9a65_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5c1cccbfe8737a34e1752a08b5c003d82
SHA132f65ad2abfb4e0317bad616721fd99d04d9e2cf
SHA2560ec06f1e4df294d03799f2bcc6f6850e9882483d3ebd262905da80741f1360c4
SHA51219326fd2c00542f6f577f35bad8e828902f83b961a125211290d12a3945f2b994f14a74c9626654b27ca2a42f0e0582580033aca5a7852b7e5858b9002bad3f9
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB