Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
26/03/2024, 14:24
General
-
Target
2024-03-26_186ab583c8afd4d9b7bc845b57b4cadf_cryptolocker.exe
-
Size
43KB
-
MD5
186ab583c8afd4d9b7bc845b57b4cadf
-
SHA1
0169b82b25223613e0a28366b9afd38479233ce4
-
SHA256
b82a4117b2e4662f01efa2ede0fafacbc1020fb1fdcbbbffd11db2c684de8682
-
SHA512
d52b2fba32761ebaa4cf66ace96dd69ec0d66697236bc3b04596bddafff9b68e142cb8478e5937c46f0c6af20d99dd1515028ac19ddb24d525f6e7cd99077904
-
SSDEEP
768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPu:P6QFElP6k+MRQMOtEvwDpjBQpVXb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_186ab583c8afd4d9b7bc845b57b4cadf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_186ab583c8afd4d9b7bc845b57b4cadf_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD59a68e7b5827c1b5df143f733110b9c63
SHA14c50b93ed93c55d242eeb0e420abd643f6f4a360
SHA2563c121d82a1dca60199535119af9cdd07aa8ac834ebc389042d70d0f9aec907d5
SHA51202f5bddcc37a8d5c0f715c603e27168521c3a78605d24712f4e9c9c63af82da94a57803ce437619458d1566f36bbb727bdc3835fb1ed1d733c006c11886f1256
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB