Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
19/01/2024, 10:15
General
-
Target
2024-01-19_ac8b758def8c9b487885246eb57d6aee_cryptolocker.exe
-
Size
44KB
-
MD5
ac8b758def8c9b487885246eb57d6aee
-
SHA1
e2eca5b3ecb11cf71a884e9ff2ba679bc09b22aa
-
SHA256
517cd83a4c51363f3ec4cbf66549666799b63f75f8a282e7df5a110b986f64b9
-
SHA512
82e2c086c4cc397ccb0b563b938f74785358e71dd5ac0cf9c76ed75c3ce0b0385bbb15bb6cda42ca2bf81a6944dd776704a64b126a8a09f7a4b9fc9a45184b15
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedmhXSJJl:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+z
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-19_ac8b758def8c9b487885246eb57d6aee_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-19_ac8b758def8c9b487885246eb57d6aee_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD54af7582930ed51465c94f452f15f0356
SHA1d3d3cea10872a3944019eb3c4aefb04f290142a8
SHA2560d057a3af9c4bb6de713e6dbb7638fff057a53d0860343cb839d2202b226d8ec
SHA51266486bc6e0500f6abcf9d72dc15c5b6a87b4c3ec6ad1c62e45f5c951e91b0351a54d01ffee54c31b66b929683a4dede451c5b613ed00539b07ae6bd7434c2642
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB