Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06-03-2024 07:27
General
-
Target
2024-03-06_7e2698b183345f1e395922e49de36c79_cryptolocker.exe
-
Size
43KB
-
MD5
7e2698b183345f1e395922e49de36c79
-
SHA1
36f2432e2fbd6d8fdca61c462f0b118bae243ab8
-
SHA256
399500b72f1db660b195a014b29705dc0c8d59f173063eb0fabaf99d9ff72af3
-
SHA512
4429062aeb7e1568e45e7aef6f3c884df5bd959f089f4b6a658e2900fc083aa0a5ae3f1412a8f59494010b5d97a9b6beea79a7edf2cfbc5c5726544096004933
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedm+Ml:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+w
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_7e2698b183345f1e395922e49de36c79_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_7e2698b183345f1e395922e49de36c79_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5103a40cc4631b1192c75c42bb5709ef4
SHA139ade905158b72cce42c9bf0be9696f3a531ef15
SHA256abed480ae26ff28217b1ee7e581352b05255916e4d740ed6f9661c7d65f9217b
SHA512957388f2bddb454f64ae5c85bf54ad4b2fece121d69478259ce0ee440ac78777553e38b278091629bd3682e983ddcb188815120ec945d1413446317aa16ba192
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB