Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03/02/2024, 09:28
General
-
Target
2024-02-03_6007cd602a1e1dfd79824ae50a0f137d_cryptolocker.exe
-
Size
47KB
-
MD5
6007cd602a1e1dfd79824ae50a0f137d
-
SHA1
cef6c9805f73fe5bd7eaae4300ded3521c942318
-
SHA256
3555faf31c42edb483c9700a57c741f0363105325cc4153456a53d7af39ad0cc
-
SHA512
ed1f33f31cbc78a982874f317d87263026c840179eecef1d60cf2a5a392ade3d522983df27fa2b8af8b54f941138a4144007a032ea140289e8c07c220d325b78
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qnTNh:79mqyNhQMOtEvwDpjBxe8Y
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_6007cd602a1e1dfd79824ae50a0f137d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_6007cd602a1e1dfd79824ae50a0f137d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5d506f6c0840e8b4ea9371a905fb65c2a
SHA1abd21de82e74e34fb68d58130c7c2216ad15ed01
SHA2569b008dadf703805c6d4895ae24966ba1f4522f2ccc29e9b92d42a51fc3023657
SHA512242278529ffd27e0ce862a4ed00405733b3823cf041377dbc9c400fa0e78bcfa6ee4703e8f64db2551bcba2b871f2e560e4818fb29e5708b6ba0f1d090a0cdc9
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB