Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
27/01/2024, 00:22
General
-
Target
2024-01-27_09c9197b57cfbce49206cd060a6e6faf_cryptolocker.exe
-
Size
61KB
-
MD5
09c9197b57cfbce49206cd060a6e6faf
-
SHA1
6d4528c601ac43eb5126777213f66391c7cd482e
-
SHA256
a8b8070615d294f31964fa255b15e175cbdf375930e2261ac2f85bdd50e36388
-
SHA512
9686bf6f5b26b0721e767240f8caab5cc0f4a0a14479c0158f6e559a003ad3821a5a2f8ddf03bbd344e3fad3105a2025e30b6a6aca023e78b6b09922a45b919d
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYibAom:1nK6a+qdOOtEvwDpjU
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_09c9197b57cfbce49206cd060a6e6faf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_09c9197b57cfbce49206cd060a6e6faf_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD51f6558f750f37aabc29337b40cacfdb1
SHA1f6acfd65a5eab6d278735f7357071ad2f9f2ce72
SHA2569e31721661689edfc43c7b4c390b290ef53382ae16a9f25ec0ec5d6cce3c314c
SHA5121736081634e0aa76e03897f069088862c6a3fc5a4a72431636a1eeffa5db5b51c180c5613562e8db8e4f8700b7f6fce0c11e28e67d26efdc807af9803acd91d4
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB