Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24/01/2024, 03:46
General
-
Target
2024-01-24_8c9e9a84d5522678e07d43ba99f40b68_cryptolocker.exe
-
Size
55KB
-
MD5
8c9e9a84d5522678e07d43ba99f40b68
-
SHA1
f640de7f6a853d8a3fcb525524275202c431135e
-
SHA256
867fda73677b5156fc931ba1ab8328aa069c8222d34f8481139a519aebd37860
-
SHA512
e287985f1681513f42663721427356cf806166ad28402c2ac656a4047c9148ee902d5f6ce0ff765769e10a852c7181751eec6882de046acd921ec6df342295dd
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5apJ:z6QFElP6n+gKmddpMOtEvwDpj9aYaX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_8c9e9a84d5522678e07d43ba99f40b68_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_8c9e9a84d5522678e07d43ba99f40b68_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD587baf4ab4df29de03d2796ad48a0055d
SHA1ba30f56917e56af5cd7453ecee5d5e59f0e68a80
SHA25648449cf4ed33c9f15088dadd04bd80baf7d9504bfde636faaa026d86c9193c3c
SHA512aaf4db63c3accb618598984a0cda1a1916cc16be4689c9b31dcf934befe948004c8f7a144d300cabedcbae256483f718cd8eaca379fde220ac124d7eafa7ca70
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB