Analysis
-
max time kernel
134s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
02/10/2023, 17:06
General
-
Target
2023-08-27_323c74ed905a9a87a26e98f99364348f_cryptolocker_JC.exe
-
Size
107KB
-
MD5
323c74ed905a9a87a26e98f99364348f
-
SHA1
8742dabfe444ceb0253b11c8d2126899081cd712
-
SHA256
ac317b3d45386b5df28c0a971db104105faa9198406eda606511bb9fe1834bf9
-
SHA512
fd499592456374f53a0f8d625aa7143ef8931985e4ff7e3bc167430c1ac2a7f07df0d6f452833affd224ab0d6bf1975264c5d7c445ebd5161d35fc2fa1ea630c
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjCGYQbN/PKwNeIS:T6a+rdOOtEvwDpjLzY
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_323c74ed905a9a87a26e98f99364348f_cryptolocker_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_323c74ed905a9a87a26e98f99364348f_cryptolocker_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD52562360825af1204a3d9524a4332176c
SHA124441ea4523bacf3a15a257328d6172d01c7f54c
SHA2561cd23bc1d24ebd80220fb6eb3b8fb70bedc0314e2c6a076cd5add4c0a495d3eb
SHA51277572826de8ff859a8a6334c390e6cb58c674484356c988c6fcc82c4eb7cdf5f83ccf9a594802f304827a43359d7eca90932971f78c7c8409d2e39044711dc36
-
Filesize
107KB
MD52562360825af1204a3d9524a4332176c
SHA124441ea4523bacf3a15a257328d6172d01c7f54c
SHA2561cd23bc1d24ebd80220fb6eb3b8fb70bedc0314e2c6a076cd5add4c0a495d3eb
SHA51277572826de8ff859a8a6334c390e6cb58c674484356c988c6fcc82c4eb7cdf5f83ccf9a594802f304827a43359d7eca90932971f78c7c8409d2e39044711dc36
-
Filesize
107KB
MD52562360825af1204a3d9524a4332176c
SHA124441ea4523bacf3a15a257328d6172d01c7f54c
SHA2561cd23bc1d24ebd80220fb6eb3b8fb70bedc0314e2c6a076cd5add4c0a495d3eb
SHA51277572826de8ff859a8a6334c390e6cb58c674484356c988c6fcc82c4eb7cdf5f83ccf9a594802f304827a43359d7eca90932971f78c7c8409d2e39044711dc36
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB