Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28-01-2024 15:35
General
-
Target
2024-01-28_ff16c2bc53b9acb37bc08a8f553b050f_cryptolocker.exe
-
Size
37KB
-
MD5
ff16c2bc53b9acb37bc08a8f553b050f
-
SHA1
83d1408766afa777c9e29f44730f4f4dd299acea
-
SHA256
70abffff6e78d5c98e9d3915a9ccecc4ac88f243f32d32c38c205b9e7f607301
-
SHA512
f0919ff9c86bc39fb34714c3e18a827dbd485ae2bab1071f82624d423dd729b8869c48620c748e31356b2de15a3ff4bc21e33f98401c3e5f6cb2e584e67516f9
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLg:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLg
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_ff16c2bc53b9acb37bc08a8f553b050f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_ff16c2bc53b9acb37bc08a8f553b050f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5a17d4657a8aff24fc2b19e1f42bdbaeb
SHA1700d5592d55dc7e1288573e06090a2f3d420d5c7
SHA256c68aad4454fa14e398e7762eff19b9b136af6e42e20bce785c3d4b9c2cad0192
SHA51215a5f35f46425f28ae95ad044ce3a5a4cb6d2080b0e1dfcd80600245d543795fcfe841acf2d0c050cfcaec3637432488a0f7640ede78e19b47407ba98f15caac
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB