Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13-03-2024 00:50
General
-
Target
2024-03-13_97512fd53f2b734fdbee327d6cdff297_cryptolocker.exe
-
Size
5.5MB
-
MD5
97512fd53f2b734fdbee327d6cdff297
-
SHA1
efd56c8a61bb14fa0358cdc6e2c13eeea9fc9677
-
SHA256
f90b4bf6fd99960d7e5becc234c6bcfc813dbba8e8e7fd49232269982bf56923
-
SHA512
9c729d8ee67b56744348f4e729d88d3b072107e4c3ec381442ed4d3ff0b6621e2835c2ae88a2b061f49a745f5b4bf9b2fd03190ae2e1c9f2d9690e274b4aa236
-
SSDEEP
98304:B2TI98GkoP+kfhZ5Tgm7jdwg+Zl3dKxikhFmg+47eggcgiP05h2VC:OI1PvfhfhOZzkzmg+8egrghz
Malware Config
Signatures
-
Detection of CryptoLocker Variants 11 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_97512fd53f2b734fdbee327d6cdff297_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_97512fd53f2b734fdbee327d6cdff297_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5b14c609a0ed56250b0a9b17cfd95dc45
SHA1e7fd6bfff3173f1e69c442c495bf8c997c72bef2
SHA256820a4ebf5fd565373335fca34821a198fdebef37a27adf511ae2b7df806d0fc3
SHA512b8903811b67669f2c7ee9e40197ef262ff66114ea3ba0a938f8e3604fdeb5b7c5d72f6fba97c76c6cb3b9ac0d7683f54a5d821d304a986fb3efa199bfc001fcf
-
Filesize
683KB
MD57fdf8e737339a2a346616d06a13004cf
SHA1888ad9cc18cc806d371a34aedb8abbb2fedb033a
SHA256af47cf493a4e363915dd9be076ec79b40c543c408e81ed05afe337945a442c1a
SHA512526c2e437f133fe0ecb568637e10bdc2d22d72cf5a5587e26c2ba7889116db7f4c773d492a0a301e0e0b179d6a56f65647417718f94ced984abda53741c9d404
-
Filesize
469KB
MD5b18e299a725db4d8ae2ef66cb7fad283
SHA127892ad77225e5287a48f671e01e5f6131e972f4
SHA256726b8421ced27ef772b5abbc27564da0cb55e55a77197d8c7f63ae4ea8562886
SHA512ebb4c03a85bb0e0ca88d03e66f882cec1fde8ab6bd733ac10e3c9c02d731bc1f3c052a13b3a517d6e673f49f24634a922576aa1dd5e8b52f524e2bc37728960f
-
Filesize
24KB
-
Filesize
8.5MB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
4KB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
4KB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
8.5MB