Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28/01/2024, 08:33
General
-
Target
2024-01-28_72ea01b35aad9b8c04b730cac060613b_cryptolocker.exe
-
Size
105KB
-
MD5
72ea01b35aad9b8c04b730cac060613b
-
SHA1
71e4a60678e443a838179811a5a8f50bd3edd55e
-
SHA256
0a8d457340ed406e62e363057496c5e5eb1917d8a56c80c4fb2f3b5195fbf2b5
-
SHA512
1b6db8363a7eeca902a2eed5b307d6b0291365d43ae2bf72b9aa923496de5a80af23a1bbcc7ce6821b219c656c73abc71ac5a4a7c98f28aed3cb014cbe3d0874
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GksX:1nK6a+qdOOtEvwDpjX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_72ea01b35aad9b8c04b730cac060613b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_72ea01b35aad9b8c04b730cac060613b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5c18135118aca55292fd68d8f6a6c7ba9
SHA1a2d0612ba367ae1b6afdec1309f796ed65ba69f7
SHA25674293dd14d1dbff4a6d0fa8a901e9c5f3ec18123bfd5a7a2caad398b57fa1bef
SHA512f0dc3f73cbfee35b6908213c056e394897ff48e6bcde03a7f905853458250218f7dbeba649a3cd37271140cf7462e16a57d330d5aad743ed90d9582cd6284ced
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB