Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
18/02/2024, 08:56
General
-
Target
2024-02-18_e7f1643651cf727ffafc2db24d72db01_cryptolocker.exe
-
Size
37KB
-
MD5
e7f1643651cf727ffafc2db24d72db01
-
SHA1
a699382dbf7b21d936b79edc326c99f69f9b6f44
-
SHA256
aba14ec6ddb4ec89c2e84075936d8b5fe1947c058a028ad7e4c6fe5c7e6d48f0
-
SHA512
0d3f9aa36e5d2007cc6d90531fba4a140bd12d5f710359b919b2ec72b9735a9e35b7fceb60020a33b179c385a770723009b93f23edeb0d5db001e3f67018fa5b
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLUb:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_e7f1643651cf727ffafc2db24d72db01_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_e7f1643651cf727ffafc2db24d72db01_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5653555b16cd91017b5966458b89f0d44
SHA1fb0903debc1ec4a2cb8bdf56151926c7721eab02
SHA256ff8e318ca0187f36e0e5408f4835ebcf394e7ee19ee567d5d1e71f2a3956c7dc
SHA512861a4b8120750ab08e1d0715fb24acb4017e8442596ed3160435d05c0bcadd6d8576d2f9ec77d3770cd8b087e346a93ef9bd9dac0a2eda10607b910138094594
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB