Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
19/02/2024, 04:47
General
-
Target
2024-02-19_657dd7b24f1b94f86f7042099bb362a8_cryptolocker.exe
-
Size
95KB
-
MD5
657dd7b24f1b94f86f7042099bb362a8
-
SHA1
21ff7dc25235b5202c76c17efd47dcb8fbdf60db
-
SHA256
7233a80ae140ef51b51c8937bcd46b1cb7bc4cf08eb148cfd889ec5655e62700
-
SHA512
37bdd776666a5bb26df11863b256fd621f539c09947f0e061b3c3697248f4b67eb490d4d324c169851860edaa60fba6f67a0a34a982ac9b4a1e86f2906f1e4b1
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp01k:AnBdOOtEvwDpj6zi
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_657dd7b24f1b94f86f7042099bb362a8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_657dd7b24f1b94f86f7042099bb362a8_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD572ca348de3dd50e3bed9216b89b12040
SHA19531e2ad5c9ff211960a6efb0be7ba12d98f7ee0
SHA2561eafea6baf99bcb357578e0201db6d977a4768ed678e0980f84c0c043fa81c04
SHA5128522c9086e6642e6f12d9e56bcf2f76008952410932e8b78d55b20a7a11a18cfba26277c9ea4e6ba19ed5106c933a582d1963e19d7e72cf6694e792dc3a16acd
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB