Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/02/2024, 16:39
General
-
Target
2024-02-01_b89442d6b581d3845b5f3fc85d000d6a_cryptolocker.exe
-
Size
36KB
-
MD5
b89442d6b581d3845b5f3fc85d000d6a
-
SHA1
bfe6fdbfe11fa9b77d96cf9b668b8d13a82e8146
-
SHA256
4df681a83c2d19e63da548ec822672e995c4a00b7f6ec662f7100849188b0f3c
-
SHA512
9c099d6909a8a37f87eeb302e20dddc7e375e266acb1fec26ea500432e1a1bb7367b4b26a59c85c64f7fd999e7fecd60fa45f1beb1c0a2723b1325844b4fc2dc
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL3:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkL3
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_b89442d6b581d3845b5f3fc85d000d6a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_b89442d6b581d3845b5f3fc85d000d6a_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD50eab376668cf0dd9cf9fdef9b5fdd2b0
SHA1a0b0de2ead24ccd25bd7495aa831db3917d36475
SHA256867b6c9256cb830e5b9e184a7276e9e33f971582b5df4d4d1823debe348076d3
SHA512fdc32e677cec17b23506d100f377f2b589ff352a5e6ad11dc66033294bf144e2509870f761eb23b21c9599fbfdeb874b6b2938c70c9ea8eff5bcff7696158335
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB