Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
04-02-2024 19:27
General
-
Target
2024-02-04_3dd5d1cac7c05313513c9f87a6da1360_cryptolocker.exe
-
Size
64KB
-
MD5
3dd5d1cac7c05313513c9f87a6da1360
-
SHA1
d133a313163383db58b680b9a92700573801058d
-
SHA256
4130b86f2a091273261b0e96dc6d3a48ab589660dee3aee73f96068f6d7ade9e
-
SHA512
619e844e5bfb3651533471bf438c3411bb59c99e539cea72d9c2ea640ff651890ecde51109d5f6066991617b86496a0b5c7bc22c119d20915d3103274ce5c20c
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUa1Fr:T6a+rdOOtEvwDpjNL
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_3dd5d1cac7c05313513c9f87a6da1360_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_3dd5d1cac7c05313513c9f87a6da1360_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD59b702b4b98793a5d1a367bff2f6fb7a1
SHA12fb6b764af304493d5d5047e939ef5d4a83ad595
SHA256d3243ea26c9144b2ab47d45a4a4a5ca8a25133f8b7e6ecfcf6bba6c6d05756b7
SHA512697f86db1d9ab2f015bc70c26780c753d753fc662536d2238f8fac175fc15c10bd3e81cdf141ba4c3519dc6e54d679472682f086b7a944be241a821f56ad8157
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB