Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04-02-2024 19:28
General
-
Target
2024-02-04_5004f9d20d7af29acbf71ace65df4ba6_cryptolocker.exe
-
Size
48KB
-
MD5
5004f9d20d7af29acbf71ace65df4ba6
-
SHA1
f59877ed89e53eb15575daaab017463218aac8e5
-
SHA256
05284f40fe2200c9e6c11ba42046c49d61cb6a020a16bdd65fe5e8be22656367
-
SHA512
37248e32599f8924285aed3774e3fbb050704d6201ed4bb19094d8f1165b90290420cd8aa224208099b8c5929f0109e2f9e6b50dba174a21805aba4dfa9687a8
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qnTHGD:79mqyNhQMOtEvwDpjBxe8GGD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 3 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_5004f9d20d7af29acbf71ace65df4ba6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_5004f9d20d7af29acbf71ace65df4ba6_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5b4349e7b5620978741c61679c0b06ab2
SHA10fda22e0f8a5bae496a20fe70d5ce780f62c7390
SHA2560afb351f303b401d34a3e127a625c7c24a5d0d0d806700d25f53d61929962d94
SHA512e74d3c2c9a6a2b0e7b6ca9482f55aa2855168de7ab7c2e9aa192e9f9e161cd85bc3a1a87d89751768fe7477e2446e7e8108277b2cfd10ebb1a64a953c5467336
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB