Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
13/02/2024, 03:37
General
-
Target
2024-02-13_14d6d01d77ab761e12a271fe74cf8f5d_cryptolocker.exe
-
Size
126KB
-
MD5
14d6d01d77ab761e12a271fe74cf8f5d
-
SHA1
a36a3552a55a48fb4ee9d41fe8d26a92ecf85a44
-
SHA256
7e6a00f6b87824b5654d742943c30eb28e8c764a6a9f34e0d71d7b8c5d3be732
-
SHA512
370ffa21b29ebbddf0d5a5de7e66f851cd1461415b3f75318a81c15c142f6801271ab3eb6446776bc12901550f9d0a12378526268cfcaf9f832e7da9286b82fc
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eIn2j:AnBdOOtEvwDpj6z9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_14d6d01d77ab761e12a271fe74cf8f5d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_14d6d01d77ab761e12a271fe74cf8f5d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5b93b4e10422a3fe633407e1a35ff5807
SHA13c60bf732b5506081fd6912eeaef12169bd613f5
SHA256c84290e33342820aea8a681b6ef2b060229e98ad3375290edbcd0c7fb13cef88
SHA51259d07ad6e16282ace2c800b05d67622e08600c77a79347253b3e8f99a40832587b88ba83f8fc24387e0ece518e256d36d3169ad24435114d66d045789fecdfa4
-
Filesize
25KB
MD5a4af38b7a171082cd0eace7f054b379c
SHA1cabbb1dbd447be60494cc63a1e56159059fbba74
SHA25653cd633de43a281b3647a5f08b8d0306aadb5329b8f1507e1333ef3357d29ffa
SHA5126647fe563606f6f1952a55b242a1c251e7ddf2b4409cc7bc79d9f499d40d176a65dab35b42ae1041d7ab14cea82885c282c5abadc96601aa096501ca585f49fb
-
Filesize
35KB
MD50c7c3923fa7b659502a8b18c3a73df04
SHA1d943d8bb1adff36161b1eb3d578b8e1da2f6c60f
SHA256fee6dcc9e32ade75f21b05c8a55bf6a2ad8d32e595b4fd36f16b055144c82eea
SHA5127fec36c9a1865fe55cb8af05313043d809ff45e724d9563423333f7bbcced75aaabd592020fdaaf9ebb9adb46ec02b8b1d0f6f819020cd5a2aa03a674711da8c
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB