Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
03-02-2024 01:42
General
-
Target
2024-02-03_0247d042230d4eafbd01db3cf58e0805_cryptolocker.exe
-
Size
107KB
-
MD5
0247d042230d4eafbd01db3cf58e0805
-
SHA1
91ec7222be49cfe7e9a9da86e2aae5d6728896f8
-
SHA256
57d9fa1b588c2d7f49d8c93f524986abeefd774371570c2c394f2a808ef3d5ae
-
SHA512
2f766cd4b4ce68edaed32c5f931d8a9aed80c5c96dd49a0ead29cc0cdbe6dc51b8b5b3453690a46b0c13a905443691b6bea1391bb4a2f22f9fd11a323d9878b4
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GksgEmS:1nK6a+qdOOtEvwDpjz
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_0247d042230d4eafbd01db3cf58e0805_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_0247d042230d4eafbd01db3cf58e0805_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD5e576ae2ffaea84b6544c2d7859a06137
SHA10e29ca8610aedb5ba3ff1cd8d78cf067f4704dea
SHA256a9b544c89f76e7554723c739356d79a5be7527160641f9eb4b05345d10b371e8
SHA5124b3ca9c90c16c62b112624d38ccddef18398f6a8aa6f881a678ba6bd66bb3335abc647ee49a0c11f2b944e582a949bfcce57385e31307d2040511c4023ffa709
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB