Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240220-en -
resource tags
-
submitted
20-02-2024 12:28
General
-
Target
2024-02-20_3a35ca6204e6d8cfe6c9e62b78aafd65_cryptolocker.exe
-
Size
53KB
-
MD5
3a35ca6204e6d8cfe6c9e62b78aafd65
-
SHA1
eafc5b2e8625c69a5b43798da4fad0eff7e95571
-
SHA256
f6cab8bf30f9870fbf8b1a9a83ac4ed84839cd445d682a9151664f3e83a0f97b
-
SHA512
52c81623a2ab7119c725a9674e8864d081816db38913522fdeb2898988bf6f2df8ca02231cdaef7df01bb7cf92fb8c9e0763ce360ff16abbf93130740d174b7e
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/iVTab3GRuv3VylSV/CCjgA:79mqyNhQMOtEvwDpjBPY7xv3g8OA
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_3a35ca6204e6d8cfe6c9e62b78aafd65_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_3a35ca6204e6d8cfe6c9e62b78aafd65_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5c766763d71d5e1e9cbccfcae2aea6595
SHA1c44ff82f0fe391d2a3ab70e8af72ee8923f6556a
SHA2569b9b1cdd6d235a9475ad7608241a1cf31f40b43227daa872f7214ce463b1bd96
SHA5129e21b6f21b59dbb46f80c95cdfff0f73ef4de6a85bc65bbaf12d7db855db45109361f8fc803a363da38ba748fca5057593c2826fdc8f55633417065663ac9d3c
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB