Analysis
-
max time kernel
141s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03/02/2024, 19:35
General
-
Target
2024-02-03_d5d7af5e2064e899e19a08275e7d83f7_cryptolocker.exe
-
Size
37KB
-
MD5
d5d7af5e2064e899e19a08275e7d83f7
-
SHA1
21dda477f667da1c32c3981d92590d4593b08580
-
SHA256
d6ebe41ec086ad7ae5cc5712ba9fb2877923be3c0896264cbc4ecec9cbd50605
-
SHA512
f218760c381db585d1e58fdad53aed130529042fb67ca95a10b79f2e79dacd2fcdeb52faab9b887071d4b3db0c0158d118992b2db3d104ada50f0b75c39dc0d5
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL0:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkL0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 3 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_d5d7af5e2064e899e19a08275e7d83f7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_d5d7af5e2064e899e19a08275e7d83f7_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD58d3931e3313142558a82692ad32e0c26
SHA14985e1a243d122055a1ca46e1e8340651879c2f2
SHA256e694d21c437e018fc1b6a049745ae6251a27c41453d1dd8396ab96e55903ed75
SHA512f2cfc109521e4587d0f208c5d985e737df45315f22c198812a3ee0d9d7dab047b0b1c82b0ccc8425d2d5d43a9a9297f7d1e421c4dcf1a8776e3972e8f1952722
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB