Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20-02-2024 14:40
General
-
Target
2024-02-20_6b198d34ce65322d22896b97e8e1566b_cryptolocker.exe
-
Size
98KB
-
MD5
6b198d34ce65322d22896b97e8e1566b
-
SHA1
3bf300758ef5694cc42c855b7cfb855890987e53
-
SHA256
621afa94f7cb9e70a3462fc1ed5c643e8aa68be647987cd52d9cc8270c8ca779
-
SHA512
4815a8056469484b248b2c35bc6b19eccc9a91bba78d935db99950df5c54f952ed13b0f9b5ab9921b9c551096c36809568735df7f9b96ec9227cab655f9204af
-
SSDEEP
1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgbwt:V6a+pOtEvwDpjtz5
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_6b198d34ce65322d22896b97e8e1566b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_6b198d34ce65322d22896b97e8e1566b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD52f895794f0d06cd16659c23728c26cf8
SHA100296e5da1aaadc1c07803c4e6c69a40fc679a48
SHA25673ab184420336f00a50b09db4e8a6766949c31112e282509d53db6cba068e77f
SHA51259275a9801a19e907d8e19484673f86303f9a539f121ccfb6110d47e70f092c30253fac1343494f28414da50ce16aba09e0882d6483731af3fa323e1d281c52e
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB