Analysis
-
max time kernel
141s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19-02-2024 19:29
General
-
Target
2024-02-19_6b22e3cd7021aaef07616afbae26ad9b_cryptolocker.exe
-
Size
117KB
-
MD5
6b22e3cd7021aaef07616afbae26ad9b
-
SHA1
527da16cd9ee758cc300d5943703293bfe04787c
-
SHA256
12ff96c34948f3aba109a15b42aac6416dec7c8d0bcdbec2484fa4de82311c45
-
SHA512
ad50368bc112fe1b04a51564c22a50af8fb0c0238e8a57f3f57dd362641225f022b11e28ca101d90f090c12a9f419dc97497f1d2d523f73f726fc02dcbf95368
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01ZNb:z6a+CdOOtEvwDpjczN
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_6b22e3cd7021aaef07616afbae26ad9b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_6b22e3cd7021aaef07616afbae26ad9b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD554e189fabf4a118b66d78f3a755074cf
SHA19dbf6559df8dfcc35736856da3c2fa849124c7c0
SHA256094a0ea8a645d8a86ae170029c4278d1eaa0d85b046f250cbddc13191d292a5d
SHA5120eec9b3e59c005b0b00a66af1a07bcd8fdbae622dccf273c82ef38b14be2ddafea50aa08b5ee82daa38accf38373c57cbd5d5e8f1accf27288e61838e3f0f882
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB