Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13-02-2024 10:49
General
-
Target
2024-02-13_f2eee3af0f50eb427ca48a78efc2b1c1_cryptolocker.exe
-
Size
93KB
-
MD5
f2eee3af0f50eb427ca48a78efc2b1c1
-
SHA1
80f97b1ea4546935207e210c11dbbc1147ea7473
-
SHA256
8df3e74b11a27f366f036b98decc82ca96f090526f7afbd03f912cb2f9445d18
-
SHA512
f3c64894e84167006d21af56ce22c9c56c43ae973df45188a382d897a0259f2bc626d3e992e1d7ea6da4d7a4fb2773ebcbe6b8032875f03c64f2f453843d76e2
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwbP:AnBdOOtEvwDpj6zH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_f2eee3af0f50eb427ca48a78efc2b1c1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_f2eee3af0f50eb427ca48a78efc2b1c1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD586bb4e2ea1fb3d89864eaaa7c23406f6
SHA1607afb179c384d43fe4b7df2614a70457df590a6
SHA2562a6bf9df5577368eea54c9314c76e9537b6100399f70c0efb92e2a1218be3ef0
SHA512affb1bf94956da61b8433bdd09db2a2ee828e6e79f42712f7ade118d632bdf8f40ce179126d76c06c2bbaadddde048e76dde67908202f48730695a6973c6382a
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB