Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
16/03/2024, 07:46
General
-
Target
2024-03-16_4672e839ae52dca21437ed8f05b91ae7_cryptolocker.exe
-
Size
49KB
-
MD5
4672e839ae52dca21437ed8f05b91ae7
-
SHA1
75653f85a4afa2e51ed38ad88ac17181d79e7572
-
SHA256
2686160af4dd9f1f2ce5e152703e721a0e1251e0765597768629e4a589056b97
-
SHA512
f58a8e34584a7579183cd576cd596ab98d06623233be3319743973df2f28a635d551ceedfc35bb655d3d033b9908742ce920f98b1e36ddc975c1629c794ab2f2
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qnTEEP:79mqyNhQMOtEvwDpjBxe81EP
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-16_4672e839ae52dca21437ed8f05b91ae7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-16_4672e839ae52dca21437ed8f05b91ae7_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5a0f91381146bcbf38d64ee4ddfd62f83
SHA173ff64dbd95fc4ce91491b5dae1beaf9245e00b0
SHA2567c772b7a3059d16bfeb58d385dbba2fb30679a959b7979a30d28b2ed1b24d099
SHA512d0dddaad1c3d315f78768e8a28e44561c3bd1a46a6c40f9660b0ba984a508c47b2e2cd35cd4c52b6aab2f3b00aff195269ba1db356610643700665d93b28f8e5
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB