Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22-02-2024 12:35
General
-
Target
2024-02-22_47ae4d07031790beabc92efe169e44d9_cryptolocker.exe
-
Size
68KB
-
MD5
47ae4d07031790beabc92efe169e44d9
-
SHA1
5cba4f7abd6a191884f04bb4dd2af73f106ea921
-
SHA256
102500b6ea10d58da387ae4f0f3006d0558e667d2015ddaa97b5f02f2143553b
-
SHA512
6efa1a17cf857a41f6eaaf813ce7cc7de3878a6c41728631712f0c0f529c6c7926d3788b3b33f749e515eebcf4ebde920636e670524983c912bf653c1bbd82a4
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUy:DW60sllyWOtEvwDpjwF854
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_47ae4d07031790beabc92efe169e44d9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_47ae4d07031790beabc92efe169e44d9_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5b67cd9bec1506cc2514d73d2bf2e9b05
SHA1816587a571af26beb21eeeefcaa01f8809f84eea
SHA256b38d3c40e49ade89f1fe8bb1b3cb824bb56ea3c771eda0115e8b717dc75fe28f
SHA5120959499283de42bed50979dd958bab5033673835a9f2de810083d7e3b45b4bd9b5d57a834cdd5a03f88e4dd5d35a853d9c48e716896331da023be5ad8b9d31cb
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB