Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
20/02/2024, 00:30
General
-
Target
2024-02-20_347ef8c004bcc5fd12ab12a5acb73d81_cryptolocker.exe
-
Size
48KB
-
MD5
347ef8c004bcc5fd12ab12a5acb73d81
-
SHA1
23fe11d99b14e95daa86e007b59e3e2bcd48f270
-
SHA256
f999d6ded1ae9d81702c2cf5ce95be54c19be5788dbf3e4c112f414a9524157b
-
SHA512
df8fde874661d78c4950c0309772a482ed5477d24b6ee568f5aa872bbd2a459d93507161833ce7f570f881eb9087d38dc9501e1b9c6f92fb0f5b5c974df37845
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qnTa/p:79mqyNhQMOtEvwDpjBxe8L/p
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_347ef8c004bcc5fd12ab12a5acb73d81_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_347ef8c004bcc5fd12ab12a5acb73d81_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5f00cb9fbdcf6ca638d0974d882a73182
SHA1047d00b94061968ee7b44bfb59510ddb6ea2f40f
SHA256d7c5756fc3a1ce5eb4963bd4b7b5c48c24d049dc01a01c65597aece6b42b5dc3
SHA51296a621587edfbeded6915514ad065603befd3f338469b067686da971b15a0c29e4f9358d080a30b0ec3576bc6fb36de23ab44bbc611a6edc3fe78abcd3fa294c
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB