Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22-02-2024 14:26
General
-
Target
2024-02-22_f573f84032d60d651cb51c8edd79e9b1_cryptolocker.exe
-
Size
117KB
-
MD5
f573f84032d60d651cb51c8edd79e9b1
-
SHA1
d7931c5e4cca1cb78ba0fe39e59763f8a4a31a3e
-
SHA256
fcd68ee11b8eeeec7da62a9b1437b39ee0fcf34c5c7cb1be18cfee093fe02284
-
SHA512
d16d346a0a11d57aa5cd848da9a336a19a046a030f169130a99b5a990cd33c612930efe15c366e472a2b59682badb0cbc75c3912bf5f1a7af2a4e5ec92e63885
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp014:z6a+CdOOtEvwDpjczW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_f573f84032d60d651cb51c8edd79e9b1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_f573f84032d60d651cb51c8edd79e9b1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD5d0f882cc98a99f379c31cfa729775dca
SHA19ec47d97faf6f9eb3684d7447eace869ec7ee4e8
SHA256787fdb2c082837a997cb91de0c0802b5f964c2b9ee3b3b4495f47cb654951de8
SHA5123738d68866e5f0b561521a3251963e66db9d3601e4582ab5e9956e18cac045452833930fdf5f06daf88f5cadb2cf4f93af722fe0bac8f9046fc66e5dd8a519dc
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB