Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
17/02/2024, 20:34
General
-
Target
2024-02-17_6957c0c213d3a3dbf286d94b92a4ee28_cryptolocker.exe
-
Size
44KB
-
MD5
6957c0c213d3a3dbf286d94b92a4ee28
-
SHA1
6aeab05ba777e3564772570f5ee05be90fc8f035
-
SHA256
713f86158186fa6daabfbc64358c033b2ba1a03ad5967fa6c77710ad1db13247
-
SHA512
a9ae2212a3f477e135b998f08621abe3590cafb163869a0a4ef8928599d04c478d4426c16b050e5c57a22935b16cdc01afc29ac7e2296d1e2565d876e03041b3
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedm+MyM:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+o
Malware Config
Signatures
-
Detection of CryptoLocker Variants 3 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_6957c0c213d3a3dbf286d94b92a4ee28_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_6957c0c213d3a3dbf286d94b92a4ee28_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD545afde454c1237c388702dc3d8dde0ef
SHA10379b87d41866ef06e9f219ce763f9d8efce266e
SHA256239482f897b1739fb03094e70ba60e4213dcf3a58f22a6e7148214da8994dbec
SHA512de57a2ee02d781b419c01f8443e6f8477c08eed4f3ab904464e6983f1ec6958e9383ecbcbe3cc6fa301c6ea04e826719d0cc906c31290e4996ce9b6031cd97e2
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB