Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
23/02/2024, 20:57
General
-
Target
2024-02-23_df584045c0c753ddcf5595f45b22996e_cryptolocker.exe
-
Size
49KB
-
MD5
df584045c0c753ddcf5595f45b22996e
-
SHA1
04d28617185a1f90e797d33e0f47e401dfe25a04
-
SHA256
d351709e1f9213a12ced5b83e6f2b1c91f504fa4928be47672ba6859f32ad735
-
SHA512
8eb88a26b7b2559a5137dc02cd3954cb876a7aee590f515e7c54518094a0124bc7ab1ffed3ecb150586e11032f0d3db0f42b40312b4bae5cf2cfc91d4445c4d3
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qnTHGSH:79mqyNhQMOtEvwDpjBxe8GGSH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_df584045c0c753ddcf5595f45b22996e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_df584045c0c753ddcf5595f45b22996e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5576383b687f5cadbef4e1d12ba098101
SHA12d8f32c511bd8b6201581b7ae9b6a294f764704d
SHA2565b416a5aad8ad5c5ef0635ed81bcc6f044fc6487b94251964fbb571ad8aab2dd
SHA5126adeacc7fd0a9b89b19bbb2815abacd04d3e1cd3138253c196426eb6af3c8ab54a0a517fc4b20bd294c9dbc80bb148994863601a0bbd6adbfce6891f3e62f423
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB