Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/02/2024, 10:49
General
-
Target
2024-02-13_f3898345a5499e8c03b33f09fb62279d_cryptolocker.exe
-
Size
93KB
-
MD5
f3898345a5499e8c03b33f09fb62279d
-
SHA1
5fd96d96abb9fefa4f8085ae27253fd62b3de5c5
-
SHA256
3d22c0cf3b20dbe951123c6d2aa914f2d8944affb0ed9df7d249dc25d5ce0a4a
-
SHA512
0a40409ddfeae1c8b9ea1a65b9df098667f251c66dcb38e9f7e3d3a2caff637efa92727d77dcc2c5b866b64a30c0408a7f1ab414c58b23baeb4d06fbd84f56dd
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwbf:AnBdOOtEvwDpj6zX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_f3898345a5499e8c03b33f09fb62279d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_f3898345a5499e8c03b33f09fb62279d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5f7523fd122e69fb0f59211049829a9c1
SHA121f4032d2ccb3d7720f6f24b102cede5b890c0c4
SHA256217965b0264addb1820024cae2d70640e3b63266044286fc9647b6986ce948de
SHA5125bc615c3adf785e2cb480ff5893898855c768e79978d3a4aa62cb62fbe945776c2e8964a2ab6d5b71c4336bdcd22d876d38f74a2693c17976c7eede299b30a5d
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB