Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
17/02/2024, 21:33
General
-
Target
2024-02-17_4645830eb7fb55571d37e8907e6b0921_cryptolocker.exe
-
Size
29KB
-
MD5
4645830eb7fb55571d37e8907e6b0921
-
SHA1
9f4430871111e7532af7464470c6d90daa044702
-
SHA256
927f27bb421891959af3011c7939873086983a6af9e8e4195ec57684a9cdb747
-
SHA512
aa9ce7e9d7ea1d116247c67206e14bb6e8ef1a8ae3d9c374dbd61816c6ab2efb186414d713da1956b53b5b9d751a992e3b1644bf0d7da1ec37081a075693a61b
-
SSDEEP
384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUr766SJ5STVnTq:bA74zYcgT/Ekd0ryfjQRSnWVTq
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_4645830eb7fb55571d37e8907e6b0921_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_4645830eb7fb55571d37e8907e6b0921_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD57f8ac50ec0474502e48e9cc082e929bc
SHA130cde30dd8baa02f72ae638ca7457e7be980ad16
SHA25635744902b77fc103f1ef15efc5b3d5b466e78f0b17533cb600cf5ce98e13d20b
SHA5123c1e077fdb983f9a4df67ccbaaaea40b16b0fec61c95bfcbb5f46e12a3c472125c367c19264574246afebc5b42648835c3d10075ea6b906940d09c9d879fa9a4
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB