Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
09-03-2024 05:37
General
-
Target
2024-03-09_e3e93a0205d183a2adcd30bc2bb7cb7e_cryptolocker.exe
-
Size
94KB
-
MD5
e3e93a0205d183a2adcd30bc2bb7cb7e
-
SHA1
8071290062ab137c2c248f790d8b0573142e7edf
-
SHA256
8af8dd49a456477505d8fd4341d454faecd937b7aa91d33e873e6ea22c93d92e
-
SHA512
69ac81b49d3691491ddd2930da1129f2ccddba397190d8cc5eb2fc65c1e2bacde153caa16701039e71517686dfa5c54146bf77fb2c9d08ef8483b5b6cd39e824
-
SSDEEP
1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgpf:V6a+pOtEvwDpjtz0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_e3e93a0205d183a2adcd30bc2bb7cb7e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_e3e93a0205d183a2adcd30bc2bb7cb7e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5af144d73caf5f954cda3088536c80570
SHA1f1e239bfaaf11e6c1225efa97768ab18ccafc895
SHA2564c9fef57147a38c503b0c1a04a13ea0332469bf4b9554209458fc8eaf0a545e6
SHA5127fb825bc3408e47409e13a1577ff5ea285384e002dfa4884dc816353e5305f30c1a4630346940a4eb87ad5415ffc35efb449344043637660ccfd616d5ec0d3aa
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB