Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
29/02/2024, 01:51
General
-
Target
2024-02-29_bef55fce1acb2eea06f66656795b4006_cryptolocker.exe
-
Size
68KB
-
MD5
bef55fce1acb2eea06f66656795b4006
-
SHA1
6019343f86127e7571406d337a594a127a46191b
-
SHA256
1ccf5ca34e65d196345c64823298f73617d6da77222eecd3a528fe908b010ffe
-
SHA512
98acd8639d56531feee1c38e76b6b74279f9d6001af24cd7ca2b522f6818f32baf85dc11f915e4138c2ac4a0016a8009a87a9a22b5282bc795f6bfda034024ab
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUx:DW60sllyWOtEvwDpjwF85/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-29_bef55fce1acb2eea06f66656795b4006_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-29_bef55fce1acb2eea06f66656795b4006_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5810143f49139794e670361ca5f1910b3
SHA1932053a2e103240752fc0fba4904cd888a14c856
SHA2569ee7bfd0c409aae92fa6fcf4e4025129b8f3d993a4ca2ece01e6c03be34358d2
SHA512c57f67be98374ca5794497f0a4cc1f2d02ee2fed69ab4462d7e393957534eef1a747554d48661f0bf853d26edff795e875eb9fdeae33c279c3c55728c3010528
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB