Analysis
-
max time kernel
152s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28-01-2024 07:36
General
-
Target
2024-01-28_9f61c3cb7548aba19858108e9cff52a1_cryptolocker.exe
-
Size
49KB
-
MD5
9f61c3cb7548aba19858108e9cff52a1
-
SHA1
3637818460e6228b0df67f067dcc7431e746823b
-
SHA256
b3bfe4753aa209e2a2d9ee67142b6da4ae4bbbcce50c4e4c4ac53be05a615cba
-
SHA512
cdab18cbd1f6d9853f1dda1c14345950c441b215a332bce24b465f588c711eb2728edc15a116162c1d485b6514e00579c4be60bf5d82f412ca6754f75dbad40f
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qn8pKIRy:79mqyNhQMOtEvwDpjBxe8TpXRy
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_9f61c3cb7548aba19858108e9cff52a1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_9f61c3cb7548aba19858108e9cff52a1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD57d9d756ba4aab51e0f1f37ab8b7fbe3f
SHA1accf63d204252d88798ffe048a813fd4f0561519
SHA256ef4edac3edca05f575d81582f06f3ba74ac5513df912d3f9cef0cbc8509afd93
SHA5126dce613b6f0115b48ec3a6ef0361f616d6fc2383874229c1e6e8fa48aff186bb7a4be132b9542b8a4d295637aa7107cf33540b5670d1f89173d53b7c253e8b82
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB