Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
23/02/2024, 19:44
General
-
Target
2024-02-23_30e404c2254af0f77356bea3620ac047_cryptolocker.exe
-
Size
4.5MB
-
MD5
30e404c2254af0f77356bea3620ac047
-
SHA1
3dd4b728dfd16a97eea9e913cc4f70a4209e9085
-
SHA256
bb9b2af399a6ad0e9584becde6b7196399c267c15dd149be51c0ef95e90cb947
-
SHA512
f39eb1f58380821435e87cd9597e41676fee549e13175e26af87895db51a6e5d5acdd20bab12bf7280aba8228acbdb6b8a9e0106fc28d682b744b7b554c8f43c
-
SSDEEP
98304:g/ZFIjBzldUfs/ZFIjBz7jSZD1tU7ymTb:g/ZFIjBzF/ZFIjBzPEUusb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detects executables built or packed with MPress PE compressor 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_30e404c2254af0f77356bea3620ac047_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_30e404c2254af0f77356bea3620ac047_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
MD593633691f653c6d9c62b97ea8282e09a
SHA13ed4d408240cbc054a0cb13b5da9c9a0406864cf
SHA25697790aff1ba69c9ca8475e025c02f3f6ad871195939532a9adc0fad663610835
SHA51271e020e711bc4c963f94663f014174dca6cc45128eefd43106716b5940991059efb0d3af7be520324708e19c5f3d09acf583f1103fedf8816dc12647a5770e1d
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB