Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22-02-2024 02:39
General
-
Target
2024-02-22_a3ab07c141baefa518950e802d6401d5_cryptolocker.exe
-
Size
67KB
-
MD5
a3ab07c141baefa518950e802d6401d5
-
SHA1
7bc988baaa4ce838ecc6e4c6ed4c4e2b0c1f8e47
-
SHA256
917b9c0e50c9e29d46b7187ead14df24e4d8ee2b3272f3f6c920fa2b54aeff0c
-
SHA512
4250f8e3eab45d6ca6373d964d90c49043176d55a5bcc343afdb0298317e163a8fe640ed24d9b9a28e61b53ed5a0d0169f381571885479f96d61b487e3e97976
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUr:DW60sllyWOtEvwDpjwF85F
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_a3ab07c141baefa518950e802d6401d5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_a3ab07c141baefa518950e802d6401d5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57014c5fa24fb0e90f3bc150dc678d5c8
SHA1d973982f0cbd2b7b7be22fe906142b4e36b434f3
SHA256aa78df12ace0b5b424c22e54c8a206ed00bf8c968e04de5054e5d29076a058c6
SHA512f6e48ef64b72d57212f959630157dbe420ba8b441142e8a4c2c384e69c68675443cca4dc8b3e61e330fa08686a5958af337bc9c961b1a5582bc4f25b68e03168
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB