Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28/02/2024, 04:55
General
-
Target
2024-02-28_5cb2caef5207d12d211a60db304c9bda_cryptolocker.exe
-
Size
88KB
-
MD5
5cb2caef5207d12d211a60db304c9bda
-
SHA1
6d8f172cbc16d38826ae5eaa7f9799c4e98c1434
-
SHA256
0c1d84ed14d2be7b912f03be6110e5fff65bf51a9f3a245a7b59357aa180415a
-
SHA512
b05c078edbff6ccb1fbc7b652947d0d66f37c79277da0a66090e75251a1ee62a126d87997f76566a5fd8daa0408f17b5d732a360b3ddc922b6b75ffc75b69687
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgS+:AnBdOOtEvwDpj6zX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_5cb2caef5207d12d211a60db304c9bda_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_5cb2caef5207d12d211a60db304c9bda_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD584601c80583d17a4fa7a242a16084c77
SHA143ca361eb4ce0d85fe9cb7f7a63f3aaa38188d38
SHA2560f6431b07aa4b066a2c08f798e5e3abaa2255a39828a9fca8e193ca25a41d4df
SHA512384ae9de9352362973067b0deb054225273ab2aac2e3191bd5655e81c0aa172c798ae54bf41ca8897abd075427612a90e79e6b89b495aa1dfd4d719f836bfb7b
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB