Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26/01/2024, 00:43
General
-
Target
2024-01-26_1d1ac70b18908f08a32cc8bf85e4a253_cryptolocker.exe
-
Size
95KB
-
MD5
1d1ac70b18908f08a32cc8bf85e4a253
-
SHA1
f8a72df89da461f4f0b6470b0cbbf941765c5025
-
SHA256
9e3b15abdbc7af93aba93f6ad5232ee5c0e2e1b618abe16bbcc32f1e76c27ba8
-
SHA512
d3ae332a6f19e94bfad24ef9bf98f209ae4558539d53c2530509380b0ca1ec645ba7ada37e761284fecc1c92a23d60584fda04fcaa1519ceea13ad1f5fa15c31
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp01hs:AnBdOOtEvwDpj6zo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_1d1ac70b18908f08a32cc8bf85e4a253_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_1d1ac70b18908f08a32cc8bf85e4a253_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5216c38365e13263338c03e8a0c556c82
SHA13eb8fbd1bdc07b63576d7be70ee59b2ecd36164f
SHA2564df864d3927fad846b05c228c5fcc3a9f7e686423b08dbf01c04d3c93f199e7a
SHA5121270982a82221762eec80b7613dcf29a20cf388a6e75af570cdf0bdc10c0159c77082bd8b8d3a89714c32282cc8e3cfbc74e8a3342c91d62e30f98c263333ec4
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB