Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
24-01-2024 04:39
General
-
Target
2024-01-24_895cfa6ffedfcc32a6c980b60c17f344_cryptolocker.exe
-
Size
105KB
-
MD5
895cfa6ffedfcc32a6c980b60c17f344
-
SHA1
a408a2975f1e866edab5fecb72a2edc38adb8002
-
SHA256
b17303de897a8595b31c3036cdc379f77aca72b05dab13cb379a72afa283bd7b
-
SHA512
c11511a4638fe78f9db60b9619bead32b3dd5e5a3f3793eb5d693c045f62edab3ff71ffb2632b24a2c1be6fdb804fe4d38c2e0f7f2da3c62d46cbc9d5f439f22
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GksY:1nK6a+qdOOtEvwDpjY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_895cfa6ffedfcc32a6c980b60c17f344_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_895cfa6ffedfcc32a6c980b60c17f344_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD570c631ff32fad361c78a6cb65068e58b
SHA13ca5a1e2e15d6a77238fb89dc42d8f940e5709dc
SHA2561f11bff2a017977023dbabf3a1904b78cad7b8d261a49642209b7486e5735882
SHA5124519e2ba130f536622259687b3dfd15c312b297895afe8bce99e6462a96e6e4c3cad339d3d26ce562768f345b01d223e408dcb32a0bcbda4e139e35167277655
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB