Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03/02/2024, 07:30
General
-
Target
2024-02-03_5f94d92f33faf8896d4371626d24da44_cryptolocker.exe
-
Size
39KB
-
MD5
5f94d92f33faf8896d4371626d24da44
-
SHA1
8a636d0babd5cf0cc3b158b0e44f21665e53fd8d
-
SHA256
0fc46d902ebe1c61e6a3cc6c798f4af346de10da37da815079f52af745feefe4
-
SHA512
fdd9b90f7cc804390b6262bd72247fe0965e8d269545b31b4341980a22c0a66851bbf0b82ea18f27b8cf94de22fc474f69a9c4cfb510451946a56fde886192a3
-
SSDEEP
768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQLI3JnoehFOP:V6QFElP6n+gMQMOtEvwDpjeJQy1hoP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_5f94d92f33faf8896d4371626d24da44_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_5f94d92f33faf8896d4371626d24da44_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD582854c6ab8955079cf622ce87bb9e2e7
SHA1181c969cb9eaa7168153aec75133c4017770e607
SHA2564037396522bf56b5a11c4005c63ccf621ef02108ea08a638ce62e9571443e9c7
SHA5120ef233c85dcf7d4d375f07a57eb1d2675a188d7e503511ac58cedf98394ccfcd5911295411a9ac1fa12f8e639d7393d93e1fa4e7253aa8621fffaa14f53c0397
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB