Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19/03/2024, 00:48
General
-
Target
2024-03-19_703c1e12178d4d0974994a7bd2bb8153_cryptolocker.exe
-
Size
41KB
-
MD5
703c1e12178d4d0974994a7bd2bb8153
-
SHA1
850ed987e18fbddb12d0ef8661b10d0eb913a43f
-
SHA256
2c919cb16e2feeec96bc66b72d265e93a93f5c6f29080a1bad2b35d8e7825a8f
-
SHA512
ea5ae41366bc1432004e45b473487d77c38f1215db4903082b4581b27927ade5be3f4635756610257e39b259feabe24185b4950961a10869410cfe08e50efa8b
-
SSDEEP
768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedg:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+c
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_703c1e12178d4d0974994a7bd2bb8153_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_703c1e12178d4d0974994a7bd2bb8153_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5a229db8c4b8c8fc674ff54de241f0c59
SHA18f20c9d0caa2c608f322b112a81bd15a0c583749
SHA256e85aff1e1d62873c0f89bd70c86a4ebbf7b9c8ce4c6a3e89992b8db64d956fdd
SHA51219d07d931c01c752d62c64c2e2091f51576ab46c4e7b431acd4fa45e53f11e1fcb98a22e1c6da5249c1743144bb2e9208e98243754c521ca3900adef3ac04728
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB