Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
23/02/2024, 13:50
General
-
Target
2024-02-23_92e9443b1d311965743837404375ee98_cryptolocker.exe
-
Size
48KB
-
MD5
92e9443b1d311965743837404375ee98
-
SHA1
d4f3127ece74a3a8ac3810a3a03777b961bb39f0
-
SHA256
061cd5b6dc1cbd6816d81d6192fd9e8357329e2d5ed3a0996f16f602495f8de3
-
SHA512
39979f495c53d7f3d2fbb14c9c468493cb0a2c59a1f5068a3439d60bad34cf1ae7aa4b248b439597994f4a21a71e474a2c266a250a481fa92a9ba6401fb248a3
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qnTEb:79mqyNhQMOtEvwDpjBxe81b
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_92e9443b1d311965743837404375ee98_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_92e9443b1d311965743837404375ee98_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD50a3fa2bb3adc2f488f8e062063d618c3
SHA16629881423dec4e638459e8ea7f2921f88b6b947
SHA256290512af3ba74e8e509a9d0a0c8ca7d324efafead0936c14757be8b291441e45
SHA512ee54a92e48a1c0d3853c52a5c294eaf1b01e2567b549ec182e72b6c3eea21cb3cce09ce8b56d52d8e4dbf15d29c39c24a98306e4c4775f7c7ff1a49720db2c4c
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB