Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
27/01/2024, 03:48
General
-
Target
2024-01-27_bbfc10142878645cc8add516b59f5d70_cryptolocker.exe
-
Size
88KB
-
MD5
bbfc10142878645cc8add516b59f5d70
-
SHA1
bb3be464762bdcd38e0d8c3201825956793a0c47
-
SHA256
6477b7b1becd7ae6ea2b9cc93cb11f40dcfec3e0334f8f14f3803227f56167d2
-
SHA512
2d0c4cff28ba8e31b9ca909d617f318d91c6cb151a15a94b42ad72da22c9187d8b0d614a2a882365103051c9c97a9d68048a03aeb6ca88ebeca1d1b914e1d66c
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMg1n:AnBdOOtEvwDpj6zx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_bbfc10142878645cc8add516b59f5d70_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_bbfc10142878645cc8add516b59f5d70_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5e24c296406f6e6922c6da05c18edeb98
SHA17c790df5267380145757061f8b9cf1d7caf504cb
SHA256b7076acae194efa4554f8926d3747e925d5276a116a671ce8b41711d69e22763
SHA5122fa2e7bf0054eca2a9d8613391f71e149b34879168835675eb6b7ef533c909e6591ed7073c18ebb75aff82543c6da7185edb52b429dd64ea994c102a337ad721
-
Filesize
88KB
MD50a89d8b7f6406b8fe96ed7f4d30090e8
SHA1013e27e1362ce4cdbb36d14be63cfbe221e0c7cd
SHA256be6b4af2e85e992e574b659e12315a41beee9769cfeb59cefcb32cd3bd53eda4
SHA51211097f4a6f90e0623e1fc57bc47580a2c6161be90677b9db2d8de062227b0999359d86d79d83ed6ae7a7e643345cc2000e4a117c54b12dd9b6d7df4f3c6c0467
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB