Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
29/01/2024, 15:42
General
-
Target
2024-01-29_6911be18acb4f05d07895bb01321aa78_cryptolocker.exe
-
Size
53KB
-
MD5
6911be18acb4f05d07895bb01321aa78
-
SHA1
386c260f4335d26b0ed94039331d0fa4946319cf
-
SHA256
fde4adcd8e282a5cfd2fc91a3c48e711a22d5cf81c1113214023590fbfa676aa
-
SHA512
884b97c16e6d63746f1fe1d67a2c5e3b6dcebc5b71e77ee49dba1684aa5184cc8ec1d28d1dfd13ae98f1aa4918c121dc8cc3a9ed7d95b714989b1bc774a66a3e
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/iVTab3GRuv3VylSV/CdS:79mqyNhQMOtEvwDpjBPY7xv3g8z
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_6911be18acb4f05d07895bb01321aa78_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_6911be18acb4f05d07895bb01321aa78_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5a03b9d0aa7f42fe5ff7b3ee880964957
SHA155b7e5e23775583d9316e52681a083e401728518
SHA2566acc294a8ca5ffb802daa5b820752e18d72de297c081b8461424c94ddc279687
SHA5128855c7874c8af4f55e678353f5bba9eec274e06e61fc72bd8ef9685dca3681f3d4de7a064f6dec416c220c249ed06e4def5bffba33ef309a6711bb5e4d7c1094
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB