Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
25/02/2024, 05:25
General
-
Target
2024-02-25_05b00216d9ce7759950efb8fec6e6685_cryptolocker.exe
-
Size
87KB
-
MD5
05b00216d9ce7759950efb8fec6e6685
-
SHA1
e76161caaa920bd9305ed50f40e50109961c2c65
-
SHA256
e8e9767e8db82303256e28b23c4990be43ad1b6f62e4f3244103873c670c6151
-
SHA512
8ba89690ed477bf8a695083ed4d04e6a711a31c809b993c77fd66cea61d49e92350f0fea12a6b0e3733b7cd88793c29dab1bbaf9b3fd1c07cab0a7b0a2c58bc1
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgLt:AnBdOOtEvwDpj6zV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_05b00216d9ce7759950efb8fec6e6685_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_05b00216d9ce7759950efb8fec6e6685_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5b1dbc782318689c2dcc8d8cc2e4e897b
SHA10784cbfa00ce5d491d4e02802541f08fe179fdb7
SHA25692b3ef8fa8057fdfe82e3dbf1f38ed06ef0755d91d9fa6f96a676afb19914e13
SHA512cb0bc4e7f4c49a75627903f3d4fb10b4ee4876d30431f02f88b9db8ab0795efd2ecc214101fa3e3124e3ac961dd95994d669ec19b2e5b0f847861566609ba95b
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB