Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12/02/2024, 20:24
General
-
Target
2024-02-12_28f52887f40540a493b4a65349e1b0b3_cryptolocker.exe
-
Size
68KB
-
MD5
28f52887f40540a493b4a65349e1b0b3
-
SHA1
b224570f9c5e79fd339e0f7576c05be934239e73
-
SHA256
fa08e25db9786599c188b009e009d3672cad2fa8c0c09ebf7cf71efd1970c5d4
-
SHA512
89accb5c1bbbcd42efb65cd1f0f2636874d57d96782167bbd95d28965b0071b849428f5dab16dd51232521d609cbbbfe5404ac6cfbe586883a5af6f831de5713
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUNa:DW60sllyWOtEvwDpjwF852
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_28f52887f40540a493b4a65349e1b0b3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_28f52887f40540a493b4a65349e1b0b3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD551482fac52aeff2a96e18348740f5668
SHA14ae559442bddaeb92269925c0402124300d09d0b
SHA2563d0aacf453648aadb55b427cb9d7778e853f1a993d71e04df14b6e455f7ff744
SHA51248078c3a38de655c9e21ce393606f06a005a3050bdaf75a874e90285082647cf5acbf53070968cc39b0e106f1753730e90b38373656076d60917478abb0cafa2
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB