Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
15/06/2024, 18:54
General
-
Target
2024-06-15_9b149a085e698846666d9cc134de86b8_cryptolocker.exe
-
Size
48KB
-
MD5
9b149a085e698846666d9cc134de86b8
-
SHA1
5eafdf492328f21f13cecf484f9309c749fee775
-
SHA256
dec833fb7826b5ff48713bfc6d74198f6f1df36618b4751682e75f355dbd9067
-
SHA512
f023075af33938bd554bc86184c80d35af50d5aaf3aab12466eded63e279398467f655de9ff8e917b448a347ed10237d60d66d0ae01b7c6399d20e7e10d31b00
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPoO:P6QFElP6k+MRQMOtEvwDpjBQpVXzO
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_9b149a085e698846666d9cc134de86b8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_9b149a085e698846666d9cc134de86b8_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD590132675cd383ea3f7a2e6a64922317b
SHA1445530bd84b72e8541e7c07d9242367c6344246d
SHA256cebbd41d7e3126a55ddae6920a6eac7c1b4a71635633f7a287f7b4476917dad2
SHA512e2ed3680d4d6a0f07ace1e5dd0b9291d46e2ad69d7d10a59955fd51da38ba6b90584a86a18a15cadd6dbfb12dd49d51a932ae5780a426595d674db9c8060fa48
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB