Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
14/03/2024, 06:03
General
-
Target
2024-03-14_4f769a489c0eb7296ce9b2ab11b6d07b_cryptolocker.exe
-
Size
68KB
-
MD5
4f769a489c0eb7296ce9b2ab11b6d07b
-
SHA1
28c7f52de67e2268ed17fea6c661a1ef828a633c
-
SHA256
bea2b95e81d05c023ea3ec160d9984d1d26d539abbca0a32177096490c254cd2
-
SHA512
bb628ddcf7e2c59dc64b47e86ad85b07d8e1d87e21e0fe323d31d658ebc6fe2929088717b30aa767606f6f02e8037f372917863359703587ce043b3249ad80ca
-
SSDEEP
1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUj:DW60sllyWOtEvwDpjwF85N
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_4f769a489c0eb7296ce9b2ab11b6d07b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_4f769a489c0eb7296ce9b2ab11b6d07b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD575ed3205cb95062e6c2bda7b73c6c28c
SHA1f245db78f33974f60e04656d8cdb4eab00f3cd86
SHA25610ee427b0a5ed0b2c29edcc8f52199521ee8f8f985cafb3ac8efa41d1093039b
SHA5129edbd71d3e99343238d4b2b980b4cf630a35edba900b3fbbe406df424efcbe325f925f2d23952622ab975af1803332bc0ca9e764f8c9e47cf9d4c7315a4cf613
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB