Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03-02-2024 03:58
General
-
Target
2024-02-03_4aa6fcade2e246bc9791d4ac8f428573_cryptolocker.exe
-
Size
64KB
-
MD5
4aa6fcade2e246bc9791d4ac8f428573
-
SHA1
1bed7ac4142d7634f60ff18ab31936343bb0d7f4
-
SHA256
5d0d485680538d0fe12e68f6599d718817f985640e8c600ff05deedd25cef78d
-
SHA512
df23dc054f828f6a52d0dd6ddac1ea4343d3b7ca21dedfd9287730ed4e42868a1b634503e91fc0f8d4735905d49b9f86e5ca5a0b18bf7cc3772b2d250b9fbf2c
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjY6UD:1nK6a+qdOOtEvwDpjy
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_4aa6fcade2e246bc9791d4ac8f428573_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_4aa6fcade2e246bc9791d4ac8f428573_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD50618a2c2e65f069cce46dae74a34d4cf
SHA1a1f1ce6b426c10c04f3b6aae4d7daec49744284c
SHA25626c0e7cd3b422a80144a08ab18efc4035b8414bce1da1b457bb7cfd2bf99d453
SHA512724a40cceb0ed7473ef1bd15eb56025dbca3717f24cf0a8b50c95d01bbc598402d5ca234459974cc926138bbd5b2cdc988fd30c2d8204d543ee23747aba90f0a
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB