Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
20-02-2024 01:23
General
-
Target
2024-02-20_0be75da12150ef1f543b46b127b6e5c2_cryptolocker.exe
-
Size
41KB
-
MD5
0be75da12150ef1f543b46b127b6e5c2
-
SHA1
8012d75477cc8da8fff7b12c12aefee502e42de5
-
SHA256
13af02c809fa00cc85cfdd700443d3ead7ec6df114ceb74e3bf32219d3d3cf62
-
SHA512
8b747e672a9da8cb1787b1156121b9a5a57be8ec973ccf8efa8c065ab0c9bf7b3520eacf8610fdaa5a63ff9db2fcc645d7e3efeab8ffb175ff6a2a4603db69d6
-
SSDEEP
384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/Wcz0BVFHxzG:79inqyNR/QtOOtEvwDpjBKcmfxa
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_0be75da12150ef1f543b46b127b6e5c2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_0be75da12150ef1f543b46b127b6e5c2_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD53c7b66864f972c01765cf9c0711659a5
SHA101d2fb7c7e5db2e2cb889082611b8904a94b2c38
SHA256a8d432182a0ac8980525906391f907ee4003664f1c4ed5063be7a08b21e72be6
SHA512b64bfc44361c94e1797a6d8a0e6b0b6a6d314c60934cb855db0e14d510e65fea1412377f6d172af33c6103e73f6ae59b767cd1388983bdc331d742ce0a1a0370
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB