Analysis
-
max time kernel
139s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
11-02-2024 20:33
General
-
Target
2024-02-11_7b995883444ded5583c3250ec83902b8_cryptolocker.exe
-
Size
69KB
-
MD5
7b995883444ded5583c3250ec83902b8
-
SHA1
1e12089d1a6eba5f74dceb41cf89f7e343632080
-
SHA256
92a3d7d0599883e53516c2673df0f20f2edb1017633d47a245fae8c95fe2ccea
-
SHA512
36354ee01c71a299b22c2af4834351959e51703407ec9f3cf7ce959c8f5233c15a06c4b3b96c76fe2a05f177cc22c975cde5190fd36e4ca522217b77e4e3f625
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUNZOl:DW60sllyWOtEvwDpjwF85O
Malware Config
Signatures
-
Detection of CryptoLocker Variants 3 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_7b995883444ded5583c3250ec83902b8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_7b995883444ded5583c3250ec83902b8_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD59c3189d4221430a0bda4d1b215a3e3db
SHA10fcad301d06eb38e5c5a4a90e845949880a1746b
SHA256c865782ee23afead272e2963131e7717ff25f7d169eb24b931e8bd0d22b2ae3c
SHA51208dfdb0b58b77ed8ef98768257399e67273c2be22b45dc474b74583458f75229674c5b1f3c395370fc26bae9cf2db52fef84b6c99b784c0ce8ba2baef7d86919
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB