Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
21-02-2024 19:50
General
-
Target
2024-02-21_a4744fb5d77cb4addce921092642711f_cryptolocker.exe
-
Size
125KB
-
MD5
a4744fb5d77cb4addce921092642711f
-
SHA1
a1f0999d17c1f10debddef72a57749d3fee9ce50
-
SHA256
dc7d18efa8aca05c8fd895c496bd88da0e9b0650eecfdc1efcadfcb9d6d9fac3
-
SHA512
af5b94f34c5b4425ca11d4142bc52bba6a4270d41f374886abeecb910ccd1dcae2ff91d527ae6396c1f33c0c91110b81141c0acc500af9c653479a7300a3291f
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eLE:AnBdOOtEvwDpj6z+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_a4744fb5d77cb4addce921092642711f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_a4744fb5d77cb4addce921092642711f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD541fcb92f9a71308b76aedaa1e013b666
SHA1cfaf835dc2709bedec116e6e961af8c066bc96fb
SHA2566424a1cc884bebdf784c5511317bde1e83621e6f1d4735c327f84a3b7a0493cc
SHA5124a93ec5c329b254bb29f21c13d504ded3038ea57934edc2d279d2299030eb39dcf26c7a0a760a677118c4b3d26a079564a6fd3eb9e629b6a374da66cdd744031
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB