Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14-02-2024 11:35
General
-
Target
2024-02-14_2868f806212c11a7976c3238a67cdb98_cryptolocker.exe
-
Size
80KB
-
MD5
2868f806212c11a7976c3238a67cdb98
-
SHA1
b5965929283b5655b0dee1182c3ee402ce4b8223
-
SHA256
3fd81deecc19fc44097040f7136aff63b6e67a07d10a929ab6f213a0a90343ca
-
SHA512
7ead7f661d46f941ebecd27bf523eda677c4c75050d830ca3cad0185b9ebf9c6b356f913092bfe8dde5295d0df7bd64834c0803ae9c19920bab3b787f72900fe
-
SSDEEP
1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBd08:T6a+rdOOtEvwDpjNtD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_2868f806212c11a7976c3238a67cdb98_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_2868f806212c11a7976c3238a67cdb98_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5e8d1ff127a69a618c5be997bb82339e7
SHA1374a2306bb878c70145e061c138c9f21dff62ca9
SHA25639a4f0e2855f09402feece9a31cbff873d35c6b1f6865f1d721470d4c7c0d3af
SHA5123f4caeabbdeb1572a12ab7cfec17b6a2ed6635e2d8fa42d2b609adc50dbadb32a6de2c5a14aacbef48c9050c2803babfa7788a9f2b16d68f969d27879390fd94
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB