Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/02/2024, 10:26
General
-
Target
2024-02-13_1d55484d4c2e5a1d3050df34ea2cf1af_cryptolocker.exe
-
Size
87KB
-
MD5
1d55484d4c2e5a1d3050df34ea2cf1af
-
SHA1
48dc0e3bd20a9339083d235280cf2de683dbb63e
-
SHA256
aa77a258ee9edd2c4801272d934bd5a415a00b3d804381126295da3bd6a799da
-
SHA512
de1d9c1356cd3bd6579d057556ff7ff394ace77692ab1702013dc7c4d962b1efdaae51c8c61f15a1b6de9ef7c35ff5f266b053bd63c5637f7a0253dd7ebf4efa
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgSn:AnBdOOtEvwDpj6zm
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_1d55484d4c2e5a1d3050df34ea2cf1af_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_1d55484d4c2e5a1d3050df34ea2cf1af_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD52cfec4788b904abd35289d8badccf11c
SHA1a80f483f41931644c9b66bdd8c520ecf97e268d1
SHA2569e80c2478995883497b324fbbc9a80111985e976b74ca6de4a81bcbef33e817a
SHA512449930a4870bc8f59fa945c0cee2bfc57e1fc9c250ba1c862e532307ecad9b84d3a831fd2cd2ff8d683b409d390f25226ca5573b31d055b63daebfdb81e93b41
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB